image:
  repository: forgejo.coulomb.social/coulomb/vergabe-teilnahme
  tag: ""             # required; pinned via helm/vergabe-teilnahme-values.yaml
  digest: ""          # preferred; takes precedence over tag
  pullPolicy: IfNotPresent

replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)

# An invited company pilot requires an immutable image and both data volumes.
pilot:
  enabled: false

service:
  type: ClusterIP
  port: 80
  targetPort: 8000

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 1000m
    memory: 1Gi

# Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
# Holds SECRET_KEY + DATABASE_URL. Deliver via the admitted platform custody lane.
envSecretName: vergabe-teilnahme-env

# Non-secret env injected directly into the Deployment.
env:
  DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
  ALLOWED_HOSTS: vergabe-teilnahme.whywhynot.de,localhost
  CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.whywhynot.de

probes:
  enabled: true
  path: /health/
  port: 8000
  hostHeader: vergabe-teilnahme.whywhynot.de   # must be in ALLOWED_HOSTS
  liveness:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 5
    failureThreshold: 3
  readiness:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3

# Existing installations remain opt-in. Pilot mode refuses ephemeral state.
# PVCs are retained on Helm uninstall; a verified off-host backup is still required.
persistence:
  media:
    enabled: false
    storageClass: local-path
    size: 5Gi
    accessMode: ReadWriteOnce
    existingClaim: ""
  appState:
    enabled: false
    storageClass: local-path
    size: 1Gi
    accessMode: ReadWriteOnce
    existingClaim: ""

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 999     # matches the 'app' user in the Dockerfile
  runAsGroup: 999
  fsGroup: 999

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false   # whitenoise + collectstatic write to /app
  capabilities:
    drop: ["ALL"]

nodeSelector: {}
tolerations: []
affinity: {}