values.yaml

# Default values for workload.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

# -- Rollout strategy for Deployment (strategy) or StatefulSet (updateStrategy)
# For Deployments: type can be "RollingUpdate" or "Recreate"
# For StatefulSets: type can be "RollingUpdate" or "OnDelete"
strategy: {}
  # type: RollingUpdate
  # rollingUpdate:
  #   maxUnavailable: 0
  #   maxSurge: 1

image:
  repository: nginx
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: "latest"

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

ports: []
  # - name: http
  #   containerPort: 80
  #   servicePort: 80
  #   protocol: TCP
  #   expose: true
  #   serviceType: ClusterIP
  #   servicePortNameOverride: webui
  #   containerPortNameOverride: webui

ingress:
  enabled: false
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts: []
    #    - host: chart-example.local
    #      paths:
    #        - path: /
    #          pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

persistence:
  enabled: false
  # size: 10Gi
  # storageClassName: standard
  # accessModes:
  #   - ReadWriteOnce
  # selectorLabels: {}
  # mountPath: /data
  # subPath: ""
  # extraVolumes: []
  # - name: logs
  #   size: 5Gi
  #   mountPath: /app/logs
  #   storageClassName: standard
  #   accessModes:
  #     - ReadWriteOnce
  #   labels: {}
  #   annotations: {}
  #   selectorLabels: {}
  #   subPath: ""
  #   readOnly: false
  # - name: config
  #   size: 1Gi
  #   mountPath: /app/config
  #   accessModes:
  #     - ReadWriteOnce

volumes:
  host: []

extraContainers: []
  # - name: log-collector
  #   image: fluent/fluent-bit:latest
  #   volumeMounts:
  #     - name: shared-logs
  #       mountPath: /var/log

extraServices: []
  # - name: device-mgmt
  #   type: LoadBalancer
  #   ports:
  #     - name: discovery
  #       port: 29810
  #       targetPort: discovery
  #       protocol: UDP
  #     - name: manager
  #       port: 29811
  #       targetPort: manager

extraVolumes: []
  # - name: shared-logs
  #   emptyDir: {}

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

nodeSelector: {}

tolerations: []

affinity: {}

health:
  livenessProbe: {}
  readinessProbe: {}
  startupProbe: {}
  # livenessProbe:
  #   httpGet:
  #     path: /
  #     port: http
  # readinessProbe:
  #   httpGet:
  #     path: /
  #     port: http

hostNetwork:
  enabled: false

networkPolicy:
  enabled: false
  # Automatically allow ingress on all ports defined in .Values.ports from anywhere.
  # Ignored when explicit ingress rules are provided. Set to false for deny-all.
  allowPortsIngress: true
  # Explicit ingress rules (override allowPortsIngress when non-empty)
  ingress: []
    # - ports:
    #     - port: 80
    #       protocol: TCP
    #   from:
    #     - namespaceSelector:
    #         matchLabels:
    #           kubernetes.io/metadata.name: monitoring
    #     - podSelector:
    #         matchLabels:
    #           app: frontend

addons:
  init:
    enabled: false
    image:
      repository: "busybox"
      tag: "latest"
      pullPolicy: IfNotPresent
    command: [ ]
    securityContext: { }
    volumeMounts: [ ]
  vpn:
    firewall: {}
    enabled: false
    image:
      # renovate: datasource=docker depName=ghcr.io/qdm12/gluetun
      repository: ghcr.io/qdm12/gluetun
      tag: v3.41.1
      pullPolicy: IfNotPresent
    provider:
      name: ""
      type: "openvpn"
    openvpn:
      auth: {}
    wireguard: {}
    config:
      timezone: UTC
      serverSelection: {}
    portForward:
      enabled: false
    persistence:
      enabled: false
      size: 1Gi
  # PostgreSQL addon - deploys a separate Deployment + Service for PostgreSQL.
  # Applications should connect via {fullname}-postgres:5432.
  postgres:
    enabled: false
    image:
      repository: postgres
      tag: 15-alpine
      pullPolicy: IfNotPresent
    auth:
      username: postgres
      # password: REQUIRED if enabled
      database: postgres
      # existingSecret: secret-name
      # existingSecretKey: postgres-password
    service:
      port: 5432
      type: ClusterIP
    resources:
      requests:
        memory: 256Mi
        cpu: 250m
      limits:
        memory: 512Mi
        cpu: 500m
    persistence:
      enabled: true
      size: 8Gi
      # existingClaim: my-pvc
      # storageClass: standard
      accessMode: ReadWriteOnce
      subPath: data
    # livenessProbe: {}  # Custom liveness probe configuration
    # readinessProbe: {} # Custom readiness probe configuration
    additionalEnv: []
    # - name: POSTGRES_INITDB_ARGS
    #   value: "--data-checksums"
    nodeSelector: {}
    tolerations: []
    affinity: {}
  cloudflareTunnel:
    enabled: false
    # FQDN that Cloudflare will route to this service (REQUIRED when enabled)
    fqdn: ""
    # Protocol for the tunnel binding (http, https, tcp)
    protocol: http
    # Target port on the service to route traffic to (REQUIRED when enabled)
    targetPort: ""
    # Path filter: restrict which paths are exposed through the tunnel.
    # Uses an nginx sidecar proxy that returns 403 for non-matching paths.
    pathFilter:
      enabled: false
      # paths:
      #   - /webhook
      #   - /api/v1
      port: 8880
      image:
        repository: nginx
        tag: alpine
    # Override the service name targeted by the tunnel (defaults to hwl.fullname)
    serviceName: ""
    # Optional: CA certificate name in the tunnel's originCaPool to trust for TLS backends
    # caPool: ""
    # Optional: Disable TLS verification to backend service
    # noTlsVerify: false
    # Reference to an existing tunnel (used when tunnel.create is false)
    tunnelRef:
      kind: ClusterTunnel   # or Tunnel
      name: ""              # REQUIRED if tunnel.create is false
      disableDNSUpdates: false
    # Create a new Tunnel/ClusterTunnel resource managed by cloudflare-operator
    tunnel:
      create: false
      kind: ClusterTunnel   # or Tunnel
      # Name for the new tunnel (defaults to {release-fullname}-tunnel)
      name: ""
      # fallbackTarget: http_status:404
      # noTlsVerify: false
      cloudflare:
        accountId: ""       # REQUIRED if tunnel.create is true
        domain: ""          # REQUIRED if tunnel.create is true
        email: ""           # REQUIRED if tunnel.create is true
        credentials: {}
          # Option 1: Reference an existing Secret (takes precedence)
          # existingSecret: cloudflare-secrets
          # Option 2: Provide credentials inline (a Secret will be created)
          # apiToken: ""    # Recommended - Cloudflare API Token
          # apiKey: ""      # Not recommended - Cloudflare Global API Key
    # Optional NetworkPolicy restricting ingress to only the tunnel-bound port (defense-in-depth)
    networkPolicy:
      enabled: false