# ============================================================================
# THE CONTRACT: this is the shape every lgkentang service fills in.
# Most services only need to set: name, image.repository, image.tag,
# and ingress.host. Everything else has a sensible default below.
# ============================================================================

# Resource name for the Deployment/Service/Ingress. Defaults to the ArgoCD
# release name if left empty. Set it explicitly so names stay stable even if
# the release is ever renamed.
name: ""

image:
  repository: traefik/whoami
  tag: latest
  pullPolicy: IfNotPresent

# How many pod replicas to run.
replicas: 1

# The port your container listens on inside the pod.
containerPort: 80

service:
  # Cluster-internal Service port (what the Ingress routes to).
  port: 80

ingress:
  # Set false for internal-only services that shouldn't be exposed/DNS'd.
  enabled: true
  className: traefik
  # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
  # this into a DNS record and cert-manager into a cert (Phases 1-2).
  host: ""
  # URL path this Ingress routes. Default "/" (catch-all). For path-based
  # routing where components share a host, give each a distinct path — e.g. the
  # frontend keeps "/" and the backend uses "/api/v1". Traefik routes the
  # longest-matching prefix, so "/api/v1/*" beats "/" automatically.
  path: /
  # Whether THIS Ingress requests a TLS cert for the host. Set false when
  # another Ingress already owns the host's cert (path-based routing on a shared
  # host: only ONE component — usually the frontend at "/" — should carry TLS +
  # the cert-manager annotation; the others just add a path rule and are served
  # over that same host cert). Avoids two Certificates fighting over one host.
  tls: true
  clusterIssuer: letsencrypt-prod
  # tlsSecretName defaults to "<name>-tls" if left unset.
  tlsSecretName: ""

# Plain, non-secret environment variables as key: value pairs.
# SECRET env vars are deliberately NOT here — those arrive in Phase 5 via the
# External Secrets Operator, so we don't build a pattern now that fights it.
env: {}
  # LOG_LEVEL: info
  # FEATURE_X_ENABLED: "true"

# Name of a Kubernetes Secret whose keys are loaded as env vars (envFrom).
# Empty = none. In Phase 5, the External Secrets Operator syncs a Secret from
# Infisical/Vault and you point this at it — so app secrets never touch git.
envFromSecret: ""

# Resource requests/limits. Conservative defaults suited to the single node.
resources:
  requests:
    cpu: 10m
    memory: 32Mi
  limits:
    memory: 128Mi