# ============================================================================
# SkillHub Helm Chart 全局配置
# ============================================================================

# ============================================================================
# 镜像配置
# ============================================================================
images:
  registry: ghcr.io/iflytek
  tag: ""
  pullPolicy: IfNotPresent

nameOverride: ""
fullnameOverride: ""

# 浏览器、CLI 和 OAuth 回调访问的公开地址（不带末尾斜杠）
publicBaseUrl: ""
deviceAuthVerificationUri: ""

auth:
  direct:
    enabled: true
    provider: local
  accountMerge:
    # Enable only after every server pod uses indexed sessions and the
    # documented legacy-session transition gate has completed.
    enabled: false
    sessionCutoverComplete: false
  ldap:
    enabled: false
    providerCode: ldap-main
    displayName: "Corporate Directory"
    authority: corp-directory
    url: ""
    startTls: false
    directoryType: OPENLDAP
    baseDn: ""
    userSearchBase: ""
    userSearchFilter: "(uid={0})"
    bindDn: ""
    subjectAttribute: ""
    subjectType: ""
    usernameAttribute: uid
    displayNameAttribute: displayName
    emailAttribute: mail
    avatarUrlAttribute: ""
    emailAuthoritative: false
    connectTimeout: PT5S
    readTimeout: PT10S
    poolWaitTimeout: PT2S
    maxConcurrentRequests: 16
    maxAttributeValues: 16
  cas:
    enabled: false
    providerCode: cas-main
    displayName: "Corporate CAS"
    authority: corp-cas
    serverUrl: ""
    serviceUrl: ""
    protocolVersion: "3.0"
    subjectType: cas_principal
    connectTimeout: PT5S
    readTimeout: PT10S
    stateTtl: PT5M
    maxResponseBytes: 1048576
    attributes:
      subject: ""
      displayName: displayName
      email: mail
      avatarUrl: ""
  dingtalk:
    enabled: false
    displayName: DingTalk
    authority: dingtalk.corp
    connectTimeout: PT5S
    readTimeout: PT10S
    maxResponseBytes: 1048576

builtinSkills:
  enabled: true

# ============================================================================
# Ingress 配置
# ============================================================================
ingress:
  enabled: false
  className: nginx
  hosts:
    - host: skills.example.com
      paths:
        - path: /
          pathType: Prefix
  annotations: {}
  tls: []
  certManager:
    enabled: false
    issuerName: letsencrypt-prod
    issuerKind: ClusterIssuer

# ============================================================================
# S3 对象存储配置
# ============================================================================
s3:
  enabled: false
  bucket: skillhub-storage
  endpoint: ""
  publicEndpoint: ""
  region: us-east-1
  forcePathStyle: true
  disableChunkedEncoding: false
  autoCreateBucket: false
  presignExpiry: PT10M
  accessKey: ""
  secretKey: ""

# ============================================================================
# Session 配置
# ============================================================================
session:
  cookieSecure: false
  redisNamespace: skillhub:session:indexed-v1
  repositoryType: indexed
  configureAction: notify-keyspace-events

# ============================================================================
# Bootstrap 管理员
# ============================================================================
bootstrapAdmin:
  enabled: true
  userId: docker-admin
  username: admin
  displayName: "Platform Admin"
  email: admin@example.com
  password: ""

# ============================================================================
# Spring Profiles
# ============================================================================
springProfilesActive: docker

# ============================================================================
# Secret 配置
# ============================================================================
existingSecret: ""

secrets:
  # 默认禁止随机 Secret；仅在非 GitOps 临时环境中按需启用
  allowAutoGenerated: false
  bootstrapAdminPassword: ""
  downloadAnonCookieSecret: ""
  oauth2GithubClientId: ""
  oauth2GithubClientSecret: ""
  oauth2DingtalkClientId: ""
  oauth2DingtalkClientSecret: ""
  ldapBindPassword: ""
  scannerLlmApiKey: ""
  scannerLlmBaseUrl: ""
  scannerLlmModel: ""

# ============================================================================
# PostgreSQL 配置（Bitnami）
# ============================================================================
postgresql:
  enabled: true

  architecture: standalone

  # Bitnami's current chart defaults to a mutable latest tag. Pin the image
  # digest so installs and rollbacks remain reproducible.
  image:
    digest: "sha256:db2312d9b243afa8c3b3f5496e478d17d0dff9791d06f3b93b9567abd86ae92f"

  auth:
    postgresPassword: ""
    database: skillhub
    username: skillhub
    password: ""

  primary:
    persistence:
      enabled: true
      size: 10Gi
      storageClass: ""
      accessModes:
        - ReadWriteOnce
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 1Gi
    extraEnvVars:
      - name: POSTGRESQL_MAX_CONNECTIONS
        value: "500"
    podAnnotations: {}
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    livenessProbe:
      enabled: true
      initialDelaySeconds: 30
      periodSeconds: 20
    readinessProbe:
      enabled: true
      initialDelaySeconds: 5
      periodSeconds: 10

  readReplicas:
    persistence:
      enabled: true
      size: 10Gi
      storageClass: ""
      accessModes:
        - ReadWriteOnce
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 1Gi
    # Hot standbys must not use a lower max_connections than the primary.
    extraEnvVars:
      - name: POSTGRESQL_MAX_CONNECTIONS
        value: "500"

  metrics:
    enabled: true
    image:
      digest: "sha256:53ab72a1b940d7637e91619f1000da9ebef14bc7dad74321a78731d65c79f55b"
    serviceMonitor:
      enabled: false

externalDatabase:
  host: ""
  port: 5432
  database: skillhub
  username: skillhub
  password: ""
  jdbcUrl: ""

# ============================================================================
# Redis 配置（Bitnami）
# ============================================================================
redis:
  enabled: true

  architecture: standalone

  # Keep the bundled Redis runtime immutable for repeatable upgrades.
  image:
    digest: "sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98"

  auth:
    enabled: true
    password: ""

  master:
    persistence:
      enabled: true
      size: 5Gi
      storageClass: ""
      accessModes:
        - ReadWriteOnce
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 512Mi
    podAnnotations: {}
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    containerSecurityContext:
      enabled: true
      runAsUser: 1001

  replica:
    persistence:
      enabled: true
      size: 5Gi
      storageClass: ""
      accessModes:
        - ReadWriteOnce
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 512Mi

  sentinel:
    enabled: false
    masterSet: mymaster
    image:
      digest: "sha256:ae75dd69c192a632bdeb21baa6721080be5b12347e52add922036398b47631da"
    service:
      ports:
        sentinel: 26379
    containerPorts:
      sentinel: 26379

  metrics:
    enabled: true
    image:
      digest: "sha256:fb1dae6add1e1104989d086d9407f7d65f58968550aa5fddea20637a758c0773"
    serviceMonitor:
      enabled: false

externalRedis:
  host: ""
  port: 6379
  username: ""
  password: ""
  tls:
    enabled: false
  connectTimeout: ""
  timeout: ""
  clientName: ""
  sentinel:
    enabled: false
    masterSet: mymaster
    nodes: []
    username: ""
    password: ""
  cluster:
    enabled: false
    nodes: []
    maxRedirects: 5

# ============================================================================
# Server 配置
# ============================================================================
server:
  enabled: true
  replicaCount: 1

  image:
    registry: ""
    tag: ""

  dependencyWait:
    image:
      registry: docker.io
      repository: library/busybox
      tag: "1.37"
      pullPolicy: IfNotPresent

  service:
    enabled: true
    type: ClusterIP
    port: 8080
    nodePort: ""
    loadBalancerIP: ""
    loadBalancerSourceRanges: []

  storage:
    # 访问模式：留空时自动判断（单副本 RWO，多副本 RWX），或手动指定
    accessMode: ""
    size: 10Gi
    storageClassName: ""

  # PVC 挂载会覆盖镜像内目录权限；使用镜像中 app 用户的组 ID 使本地存储可写
  podSecurityContext:
    fsGroup: 101
    fsGroupChangePolicy: OnRootMismatch

  resources:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1Gi

  javaOpts: ""
  extraEnv: []
  podAnnotations: {}
  imagePullSecrets: []
  nodeSelector: {}
  tolerations: []
  affinity: {}

  probes:
    startup:
      httpGet:
        path: /actuator/health
        port: http
      initialDelaySeconds: 10
      periodSeconds: 10
      failureThreshold: 30
    readiness:
      httpGet:
        path: /actuator/health
        port: http
      initialDelaySeconds: 20
      periodSeconds: 10
    liveness:
      httpGet:
        path: /actuator/health
        port: http
      initialDelaySeconds: 30
      periodSeconds: 15

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 10
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  podDisruptionBudget:
    enabled: false
    minAvailable: 1

# ============================================================================
# Web 配置
# ============================================================================
web:
  replicaCount: 1
  image:
    registry: ""
    tag: ""

  service:
    enabled: true
    type: ClusterIP
    port: 80
    nodePort: ""
    loadBalancerIP: ""
    loadBalancerSourceRanges: []

  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 200m
      memory: 256Mi

  extraEnv: []
  podAnnotations: {}
  imagePullSecrets: []
  nodeSelector: {}
  tolerations: []
  affinity: {}

  probes:
    readiness:
      httpGet:
        path: /nginx-health
        port: http
      initialDelaySeconds: 5
      periodSeconds: 10
    liveness:
      httpGet:
        path: /nginx-health
        port: http
      initialDelaySeconds: 10
      periodSeconds: 15

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  podDisruptionBudget:
    enabled: false
    minAvailable: 1

# ============================================================================
# Scanner 配置
# ============================================================================
scanner:
  enabled: true
  replicaCount: 1
  image:
    registry: ""
    tag: ""

  service:
    port: 8000

  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

  extraEnv: []
  podAnnotations: {}
  imagePullSecrets: []
  nodeSelector: {}
  tolerations: []
  affinity: {}

  probes:
    readiness:
      httpGet:
        path: /health
        port: http
      initialDelaySeconds: 10
      periodSeconds: 10
    liveness:
      httpGet:
        path: /health
        port: http
      initialDelaySeconds: 20
      periodSeconds: 15

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  podDisruptionBudget:
    enabled: false
    minAvailable: 1
