# values/gitlab.values.yaml
# GitLab with Authentik OIDC SSO Integration

global:
  hosts:
    domain: kube.huskypup.net
    gitlab:
      name: gitlab.kube.huskypup.net
    registry:
      name: registry.gitlab.kube.huskypup.net
      tls:
        secretName: gitlab-tls
    minio:
      name: minio.gitlab.kube.huskypup.net
      tls:
        secretName: gitlab-tls
    kas:
      name: kas.kube.huskypup.net
      tls:
        secretName: gitlab-tls
  
  # Ingress disabled - Istio VirtualServices handle routing
  ingress:
    enabled: false
    configureCertmanager: false  # Use cluster-wide cert-manager, not GitLab's
  
  # Edition: Community Edition
  edition: ce
  
  # Time zone
  time_zone: UTC
  
  # Email configuration (configure as needed)
  email:
    from: 'gitlab@kube.huskypup.net'
    display_name: GitLab
    reply_to: 'noreply@kube.huskypup.net'
  
  # External PostgreSQL configuration
  # NOTE: PgBouncer service currently has no endpoints (replicas=0),
  # so GitLab is pointed directly at the CNPG primary service.
  psql:
    host: pg-gitlab-rw.gitlab.svc.cluster.local
    port: 5432
    database: gitlabhq_production
    username: app
    password:
      secret: pg-gitlab-app
      key: password
  
  # Gitaly configuration - using Praefect for HA
  gitaly:
    enabled: true  # Enabled to deploy Gitaly pods
    internal:
      names: []  # No internal Gitaly, using Praefect
    external: []  # Praefect configured below
  
  # Praefect configuration
  praefect:
    enabled: true
    
    # Use CNPG database secret
    dbSecret:
      secret: pg-praefect-app
      key: password
    
    virtualStorages:
    - name: default
      gitalyReplicas: 3  # Production HA
      maxUnavailable: 1
    
    # Praefect PostgreSQL configuration
    psql:
      host: pg-praefect-rw.gitlab.svc.cluster.local
      port: 5432
      dbName: praefect_production
      user: app
  
  # External Redis configuration - using standalone Redis for writes
  # (replicated Redis service causes READONLY errors from replicas)
  redis:
    host: redis-gitlab-standalone.gitlab.svc.cluster.local
    port: 6379
    auth:
      enabled: true
      secret: redis-gitlab-secret
      key: password
  
  # Application Configuration
  appConfig:
    # OmniAuth SSO Configuration
    #
    # CORRECTED 2026-08-21 (second time - see git history for the wrong
    # 2026-08-20 fix that removed this list entirely). This IS the real,
    # actually-processed OIDC config mechanism for the CNG webservice
    # image (chart's gitlab.appConfig.omniauth.configuration template,
    # infra/_omniauth.tpl) - GITLAB_OMNIBUS_CONFIG below is an
    # omnibus-image-only convention this image never processes, so it
    # was always a documentation-only no-op despite looking functional.
    # gitlab-oidc-secret's `provider` key now holds a full YAML-encoded
    # provider block (apps/gitlab/manifests/external-secret-oidc.yaml),
    # loaded via Ruby's YAML.load_file at container start - not raw
    # client_id/secret strings, which is why plain GITLAB_OIDC_CLIENT_ID/
    # SECRET keys alone (yesterday's assumption) were never enough.
    omniauth:
      enabled: true
      allowSingleSignOn: ['openid_connect']
      blockAutoCreatedUsers: false
      autoLinkUser: ['openid_connect']
      syncProfileFromProvider: ['openid_connect']
      syncProfileAttributes: ['email', 'name']
      providers:
        - secret: gitlab-oidc-secret
          key: provider
  
# Settings for Let's Encrypt ACME Issuer - disabled, using cluster-wide cert-manager
certmanager-issuer:
  email: admin@kube.huskypup.net
  
  # Authentik OIDC Configuration via Rails omnibus config
  # Note: Credentials are loaded from gitlab-oidc-secret via environment variables
  
  # SAML Configuration via Rails omnibus config
  # Note: SAML provider configuration is loaded from gitlab-saml-secret

# PostgreSQL (external via CloudNativePG)
postgresql:
  install: false

# Redis (external)
redis:
  install: false

# PgBouncer connection pooler
# NOTE: PgBouncer is deployed via CNPG Pooler CRD (see pgbouncer-pooler.yaml)
# This setting disables GitLab's bundled PgBouncer chart
pgbouncer:
  enabled: false  # Using external CNPG Pooler instead

# MinIO for object storage
minio:
  persistence:
    storageClass: rook-ceph-block
    size: 100Gi  # Production storage
  resources:
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      memory: 2Gi

# Container Registry - enabled with S3 storage
registry:
  enabled: true
  hpa:
    minReplicas: 1
    maxReplicas: 1
  resources:
    requests:
      cpu: 25m
      memory: 128Mi
    limits:
      memory: 1Gi

# GitLab components
gitlab:
  # GitLab Webservice - Main application
  webservice:
    minReplicas: 2
    maxReplicas: 3
    workerProcesses: 3

    # Note: hostAliases for OIDC SSL validation are applied via helmfile postsync hook
    # (GitLab chart doesn't support hostAliases in values.yaml)
    
    extraEnvFrom:
      GITLAB_OIDC_CLIENT_ID:
        secretKeyRef:
          name: gitlab-oidc-secret
          key: GITLAB_OIDC_CLIENT_ID
      GITLAB_OIDC_CLIENT_SECRET:
        secretKeyRef:
          name: gitlab-oidc-secret
          key: GITLAB_OIDC_CLIENT_SECRET
      GITLAB_SAML_IDP_FINGERPRINT:
        secretKeyRef:
          name: gitlab-saml-secret
          key: GITLAB_SAML_IDP_FINGERPRINT
      GITLAB_SAML_IDP_SSO_URL:
        secretKeyRef:
          name: gitlab-saml-secret
          key: GITLAB_SAML_IDP_SSO_URL
    extraEnv:
      GITLAB_OMNIBUS_CONFIG: |
        # Authentik OIDC Configuration
        gitlab_rails['omniauth_enabled'] = true
        gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect', 'saml']
        gitlab_rails['omniauth_block_auto_created_users'] = false
        gitlab_rails['omniauth_auto_link_user'] = ['openid_connect', 'saml']
        gitlab_rails['omniauth_auto_sign_in_with_provider'] = nil
        gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect', 'saml']
        gitlab_rails['omniauth_sync_profile_attributes'] = ['email', 'name']
        
        gitlab_rails['omniauth_providers'] = [
          {
            'name' => 'openid_connect',
            'label' => 'Authentik',
            'args' => {
              'name' => 'openid_connect',
              'scope' => ['openid', 'profile', 'email'],
              'response_type' => 'code',
              'issuer' => 'https://auth.kube.huskypup.net/application/o/gitlab/',
              'discovery' => true,
              'client_auth_method' => 'query',
              'uid_field' => 'sub',
              'send_scope_to_token_endpoint' => true,
              'pkce' => true,
              'client_options' => {
                'identifier' => ENV['GITLAB_OIDC_CLIENT_ID'],
                'secret' => ENV['GITLAB_OIDC_CLIENT_SECRET'],
                'redirect_uri' => 'https://gitlab.kube.huskypup.net/users/auth/openid_connect/callback'
              }
            }
          },
          {
            'name' => 'saml',
            'label' => 'Authentik SAML',
            'args' => {
              'assertion_consumer_service_url' => 'https://gitlab.kube.huskypup.net/users/auth/saml/callback',
              'idp_cert_fingerprint' => ENV['GITLAB_SAML_IDP_FINGERPRINT'],
              'idp_sso_target_url' => ENV['GITLAB_SAML_IDP_SSO_URL'],
              'issuer' => 'https://gitlab.kube.huskypup.net',
              'name_identifier_format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
              'attribute_statements' => {
                'email' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
                'name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
                'first_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'],
                'last_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname']
              }
            }
          }
        ]
    # Homelab resource allocation
    resources:
      requests:
        cpu: 300m
        memory: 2Gi
      limits:
        memory: 4Gi

  # GitLab KAS (Kubernetes Agent Server) - enabled for Kubernetes cluster integration
  kas:
    enabled: true
    minReplicas: 1
    maxReplicas: 1
    resources:
      requests:
        cpu: 25m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 1Gi

   # Gitaly Cluster (Praefect) - High Availability Git storage
  gitaly:
    # Note: enabled is in global.gitaly
    persistence:
      storageClass: rook-ceph-block
      size: 200Gi  # Production storage
    # Production resources
    resources:
      requests:
        cpu: 100m
        memory: 512Mi
      limits:
        cpu: "1"
        memory: 2Gi
  
  # GitLab Runner - enabled for CI/CD
  gitlab-runner:
    install: false  # Will be installed separately
  
  # Praefect - Gitaly Cluster routing and transaction manager
  praefect:
    enabled: true
    minReplicas: 1
    maxReplicas: 1
    
    # Note: Praefect PostgreSQL config is in global.praefect.psql
    
    # Use CNPG-generated database secret
    dbSecret:
      secret: pg-praefect-app
      key: password
    
    # Resources
    resources:
      requests:
        cpu: 25m
        memory: 256Mi
      limits:
        cpu: 250m
        memory: 512Mi
    
    # Virtual storage configuration
    virtualStorages:
    - name: default
      gitalyReplicas: 1  # Homelab sizing
      maxUnavailable: 1
  
  # GitLab Exporter for Prometheus metrics
  gitlab-exporter:
    enabled: true
    metrics:
      enabled: true
  
  # Sidekiq background jobs
  sidekiq:
    minReplicas: 1
    maxReplicas: 1
    
    # Note: hostAliases applied via helmfile postsync hook
    
    # Homelab resources
    resources:
      requests:
        cpu: 25m
        memory: 512Mi
      limits:
        cpu: 250m
        memory: 2Gi

# Disable components we already have in the cluster
certmanager:
  install: false  # Using cluster-wide cert-manager
  installCRDs: false

prometheus:
  install: false  # Using existing Prometheus

nginx-ingress:
  enabled: false  # Istio handles ingress

# Disable GitLab Runner (configure separately if needed)
gitlab-runner:
  install: false