values.yaml

# LogTide Helm Chart - Default Values
# https://logtide.dev

# Global settings
global:
  # Image pull secrets for private registries
  imagePullSecrets: []
  # Storage class for persistent volumes
  storageClass: ""

# =============================================================================
# BACKEND CONFIGURATION
# =============================================================================
backend:
  enabled: true
  replicaCount: 2

  image:
    repository: ghcr.io/logtide-dev/logtide-backend
    tag: ""  # Defaults to appVersion
    pullPolicy: IfNotPresent

  # Container port (must match the port your backend listens on)
  containerPort: 8080

  service:
    type: ClusterIP
    port: 8080

  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 1000m
      memory: 1Gi

  # Horizontal Pod Autoscaler
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70
    targetMemoryUtilizationPercentage: 80

  # Health probes
  livenessProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3

  readinessProbe:
    enabled: true
    initialDelaySeconds: 10
    periodSeconds: 5
    timeoutSeconds: 3
    failureThreshold: 3

  # Node selector, tolerations, affinity
  nodeSelector: {}
  tolerations: []
  affinity: {}

  # Pod disruption budget
  podDisruptionBudget:
    enabled: true
    minAvailable: 1

# =============================================================================
# FRONTEND CONFIGURATION
# =============================================================================
frontend:
  enabled: true
  replicaCount: 2

  image:
    repository: ghcr.io/logtide-dev/logtide-frontend
    tag: ""  # Defaults to appVersion
    pullPolicy: IfNotPresent

  # Public API URL for browser requests (base URL without /api suffix)
  # This URL must be accessible from the user's browser (not internal k8s DNS)
  # If empty and ingress is enabled, defaults to https://{ingress-host}
  # Examples:
  #   - "https://logtide.example.com" (with ingress)
  #   - "http://localhost:8080" (local development with port-forward)
  publicApiUrl: ""

  service:
    type: ClusterIP
    port: 3000

  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 5
    targetCPUUtilizationPercentage: 70

  livenessProbe:
    enabled: true
    initialDelaySeconds: 15
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3

  readinessProbe:
    enabled: true
    initialDelaySeconds: 5
    periodSeconds: 5
    timeoutSeconds: 3
    failureThreshold: 3

  nodeSelector: {}
  tolerations: []
  affinity: {}

# =============================================================================
# WORKER CONFIGURATION (BullMQ)
# =============================================================================
worker:
  enabled: true
  replicaCount: 2

  image:
    repository: ghcr.io/logtide-dev/logtide-backend
    tag: ""  # Defaults to appVersion
    pullPolicy: IfNotPresent

  # Worker command override
  command: ["node"]
  args: ["dist/worker.js"]

  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 8
    targetCPUUtilizationPercentage: 70

  nodeSelector: {}
  tolerations: []
  affinity: {}

# =============================================================================
# INGRESS CONFIGURATION
# =============================================================================
ingress:
  enabled: false
  className: nginx

  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # cert-manager.io/cluster-issuer: letsencrypt-prod

  hosts:
    - host: logtide.example.com
      paths:
        - path: /
          pathType: Prefix
          service: frontend
        - path: /api
          pathType: Prefix
          service: backend
        - path: /v1
          pathType: Prefix
          service: backend

  tls: []
    # - secretName: logtide-tls
    #   hosts:
    #     - logtide.example.com

# =============================================================================
# TIMESCALEDB CONFIGURATION (embedded - used when storageEngine: timescale)
# =============================================================================
timescaledb:
  # Use embedded TimescaleDB StatefulSet
  enabled: true

  image:
    repository: timescale/timescaledb
    tag: latest-pg15
    pullPolicy: IfNotPresent

  auth:
    # Will be stored in Secret
    postgresPassword: ""  # Required - set via --set or values file
    database: logtide
    username: logtide
    password: ""  # Required - set via --set or values file

  persistence:
    enabled: true
    size: 50Gi
    storageClass: ""

  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: 2000m
      memory: 4Gi

  # TimescaleDB tuning
  config:
    shared_buffers: 1GB
    effective_cache_size: 3GB
    maintenance_work_mem: 512MB
    work_mem: 64MB
    max_connections: 200
    timescaledb.max_background_workers: 8

  nodeSelector: {}
  tolerations: []
  affinity: {}

# External PostgreSQL/TimescaleDB (if timescaledb.enabled: false)
externalDatabase:
  host: ""
  port: 5432
  database: logtide
  username: logtide
  password: ""
  # Use existing secret
  existingSecret: ""
  existingSecretPasswordKey: "password"

# =============================================================================
# CLICKHOUSE CONFIGURATION (used when storageEngine: clickhouse)
# =============================================================================
clickhouse:
  # Connection to an external ClickHouse instance
  host: ""
  port: 8123
  database: logtide
  username: default
  password: ""
  # Use existing secret for the password
  existingSecret: ""
  existingSecretPasswordKey: "password"

# =============================================================================
# MONGODB CONFIGURATION (used when storageEngine: mongodb)
# =============================================================================
mongodb:
  # Option 1: full connection URI (takes precedence over individual settings)
  # e.g. "mongodb://user:pass@host:27017/logtide?authSource=admin"
  uri: ""
  # Option 2: individual connection settings
  host: ""
  port: 27017
  database: logtide
  username: ""
  password: ""
  authSource: ""
  # Use existing secret for uri or password
  existingSecret: ""
  existingSecretPasswordKey: "password"

# =============================================================================
# REDIS CONFIGURATION
# =============================================================================
redis:
  # Use embedded Redis StatefulSet
  enabled: true

  image:
    repository: redis
    tag: 7-alpine
    pullPolicy: IfNotPresent

  auth:
    enabled: true
    password: ""  # Required - set via --set or values file

  persistence:
    enabled: true
    size: 10Gi
    storageClass: ""

  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}

# External Redis (if redis.enabled: false)
externalRedis:
  host: ""
  port: 6379
  password: ""
  # Use existing secret
  existingSecret: ""
  existingSecretPasswordKey: "password"

# =============================================================================
# APPLICATION CONFIGURATION
# =============================================================================
config:
  # Node environment
  nodeEnv: production

  # Log level (debug, info, warn, error)
  logLevel: info

  # Storage engine: timescale | clickhouse | mongodb
  # - timescale: uses the embedded or external TimescaleDB (default)
  # - clickhouse: uses external ClickHouse (configure clickhouse section)
  # - mongodb: uses external MongoDB (configure mongodb section)
  storageEngine: timescale

  # Trust reverse proxy headers (X-Forwarded-For, X-Forwarded-Proto)
  # Set to true when running behind nginx/traefik ingress
  trustProxy: true

  # Frontend URL for OIDC redirects
  # Defaults to https://{ingress-host} when ingress is enabled
  frontendUrl: ""

  # JWT secret for authentication (auto-generated if empty)
  jwtSecret: ""

  # Session secret (auto-generated if empty)
  sessionSecret: ""

  # API key encryption secret (auto-generated if empty)
  # Used to encrypt API keys at rest. Must be at least 32 characters.
  apiKeySecret: ""

  # CORS origins (comma-separated). Defaults to ingress host when enabled.
  corsOrigins: ""

  # Response caching
  cache:
    enabled: true
    ttl: 60  # seconds

  # General rate limiting
  rateLimit:
    max: 1000       # requests per window
    window: 60000   # window in ms (1 minute)

  # Auth-specific rate limiting
  authRateLimit:
    register: 10       # registrations per window
    login: 20          # login attempts per window
    window: 900000     # window in ms (15 minutes)

  # Retention policy (days)
  retention:
    logs: 30
    alerts: 90
    incidents: 365

  # SMTP configuration for email notifications
  smtp:
    enabled: false
    host: ""
    port: 587
    secure: false
    user: ""
    pass: ""
    from: "noreply@logtide.dev"
    # Use existing secret for SMTP credentials
    existingSecret: ""

  # Initial admin user (created on first deployment if no users exist)
  initialAdmin:
    email: ""
    password: ""
    name: ""

# =============================================================================
# MONITORING & OBSERVABILITY
# =============================================================================
metrics:
  enabled: true

  # ServiceMonitor for Prometheus Operator
  serviceMonitor:
    enabled: false
    namespace: ""
    interval: 30s
    scrapeTimeout: 10s
    labels: {}
    annotations: {}

# =============================================================================
# SERVICE MESH
# =============================================================================
serviceMesh:
  # Istio sidecar injection
  istio:
    enabled: false

  # Linkerd annotations
  linkerd:
    enabled: false

# =============================================================================
# SECURITY CONTEXT
# =============================================================================
# Container security context
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

# Pod security context
podSecurityContext:
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault

# =============================================================================
# SERVICE ACCOUNT
# =============================================================================
serviceAccount:
  create: true
  name: ""
  annotations: {}

# =============================================================================
# NETWORK POLICIES
# =============================================================================
networkPolicy:
  enabled: false
  # Allow traffic from specific namespaces
  allowedNamespaces: []