# MinIO on the VPS - shared backup-receiver bucket for the vps-standby site.
# Standalone mode: single node, single VPS disk, no erasure coding needed here -
# this is a backup *copy*, not itself something requiring HA.
#
# rootUser/rootPassword are intentionally left unset: the chart auto-generates
# a random root password and stores it in a Secret (minio/minio chart default
# behavior) rather than committing credentials to git. Retrieve after first
# deploy with:
#   kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d

mode: standalone

persistence:
  enabled: true
  storageClass: local-path
  size: 150Gi  # budget out of the VPS's 360GB disk; leaves room for Phase 2 standby PVCs

resources:
  requests:
    cpu: 50m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 1Gi

# Buckets used by the backup/standby plumbing (Phase 1b / Phase 2). Created on
# first deploy; safe to append to as later phases land.
buckets:
  - name: vault-raft-snapshots
    policy: none
    purge: false
  - name: cnpg-backups
    policy: none
    purge: false
  - name: nextcloud-files
    policy: none
    purge: false

# No ingress here - MinIO is reached over Netbird (while home is up) or from
# workloads inside the vps-standby cluster itself. It never needs to be public.
ingress:
  enabled: false

# NodePort so home-cluster CronJobs (vault raft snapshots, CNPG barman backups,
# Nextcloud PVC sync) can reach this over the Netbird tunnel at
# <VPS_NETBIRD_IP>:30900 - single-node cluster, so NodePort is simplest here.
# Verify the exact key path against `helm show values minio/minio` for the
# deployed chart version (5.4.0) before applying - not confirmed live.
service:
  type: NodePort
  nodePort: 30900

metrics:
  serviceMonitor:
    enabled: false  # no Prometheus on the VPS cluster (out of scope for this build)