# Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
# (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
# background; the app itself is NOT run in normal operation (replicas: 0)
# since the replica DB is read-only until a deliberate manual promotion -
# an Authentik pod trying to write against a read-only DB would just
# crashloop uselessly. Promotion runbook: flip the CNPG cluster's
# spec.replica.enabled to false (see cnpg-cluster.yaml), then scale
# server/worker up from 0.
#
# The `authentik:` block below (secret_key/postgresql "env://" indirection)
# is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
# the authentik chart deterministically renders its own generated Secret
# from these literal values.yaml strings (not randomly), so keeping this
# block byte-identical between home and VPS means both clusters
# independently arrive at the same AUTHENTIK_SECRET_KEY without needing to
# manually copy it - required for promotion to work, since that key
# decrypts things (stored provider secrets, cert private keys) that live
# encrypted in the DB being replicated.
authentik:
  secret_key: env://AUTHENTIK_SECRET_KEY
  postgresql:
    host: env://AUTHENTIK_POSTGRESQL__HOST
    port: 5432
    name: env://AUTHENTIK_POSTGRESQL__NAME
    user: env://AUTHENTIK_POSTGRESQL__USER
    password: env://AUTHENTIK_POSTGRESQL__PASSWORD

global:
  envFrom:
    - secretRef:
        name: authentik
    - secretRef:
        name: pg-authentik-app
      prefix: AUTHENTIK_POSTGRESQL__
  env:
    - name: AUTHENTIK_URL
      value: "https://auth.kube.huskypup.net"
    - name: AUTHENTIK_POSTGRESQL__HOST
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: host
    - name: AUTHENTIK_POSTGRESQL__NAME
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: dbname
    - name: AUTHENTIK_POSTGRESQL__USER
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: username
    - name: AUTHENTIK_POSTGRESQL__PASSWORD
      valueFrom:
        secretKeyRef:
          name: pg-authentik-app
          key: password
    - name: AUTHENTIK_POSTGRESQL__PORT
      value: "5432"

server:
  replicas: 0
  containerSecurityContext:
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests:
      cpu: 50m
      memory: 512Mi
    limits:
      memory: 1Gi
  metrics:
    enabled: false

worker:
  replicas: 0
  containerSecurityContext:
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests:
      cpu: 50m
      memory: 512Mi
    limits:
      memory: 1Gi
  metrics:
    enabled: false

# Disable bundled Postgres - using the CNPG replica cluster instead
postgresql:
  enabled: false