---
# Source: preprocess stage 3/templates/values_template.yaml
# Source: preprocess stage 2/templates/values_template.yaml
timeZone: America/Chicago
customer: ap-dev
domain: ap-dev.digitalwavetechnology.com
protocol: https://
local_user_id: 1000
local_user_name: ubuntu
local_group_id: 1000
local_group_name: ubuntu
pim_api_url: ""
coder_prefix: "coder-"
clearml_prefix: "clearml."
password_login: true
cookie_session_name: _hyd
cookie_session_no_expires: "1"
cookie_session_max_age: 604800
cookie_session_http_only: true
cookie_session_secure: true
cookie_session_domain: ""
persistent_volume_claim: ""
customer_data_pvc_enabled: true
azure: false
access_control:
  enabled: true
  version: "1"
authenticator:
  enabled: true
  version: "2"
  proxy_locations: |
    location /authenticator/login {
      proxy_pass http://authenticator;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Port $server_port;

      proxy_read_timeout 600;
    }
    location @auth-check-failed {
      return 302 $scheme://$host/authenticator/login?redirect=$request_uri;
    }
    location /auth-check-basic {
      internal;
      proxy_method GET;
      proxy_pass http://authenticator/authenticator/check-basic;
    }
argo_events:
  enabled: false
rabbitmq:
  enabled: false
  fullnameOverride: rabbitmq
  auth:
    username: admin
    password: admin
    erlangCookie: erlangCookiesecretcookie
  service:
    type: NodePort
    port: 33333
  persistence:
    existingClaim: customer-data
    subPath: data/rabbitmq
  volumePermissions:
    enabled: true
pre_install_hook:
  enabled: true
  image: docker.io/goalprofit/env:1.2
argocd:
  enabled: false
  sync_window_start: "* * * * *"
  sync_window_duration: 1h
api_router:
  enabled: true
  version: "1.2.0"
  environment: "production"
  proxy_upstreams: |
    upstream api_router {
      server api-router:8080;
    }
    upstream api_router_auth {
      server server:8080;
    }
  proxy_locations: |
    location /api {
        auth_request /api_auth;
        proxy_pass http://api_router/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /api_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://api_router_auth/graphql;
    }
api_router_schema_updater:
  enabled: true
  version: "1.0.0"
  proxy_upstreams: |
    upstream api_router_schema_updater {
      server api-router-schema-updater:8080;
    }
    upstream api_router_schema_updater_auth {
      server server:8080;
    }
  proxy_locations: |
    location /api-router-schema-updater {
        auth_request /api_router_schema_updater_auth;
        proxy_pass http://api_router_schema_updater/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /api_router_schema_updater_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://api_router_schema_updater_auth/graphql;
    }
assets_inlet:
  enabled: false
  version: "1.0.0"
  proxy_upstreams: |
    upstream assets_inlet {
      server assets-inlet:8080;
    }
    upstream assets_inlet_auth {
      server server:8080;
    }
  proxy_locations: |
    location /assets-inlet {
        auth_request /assets_inlet_auth;
        rewrite ^/assets-inlet(.*)$ $1 break;
        proxy_pass http://assets_inlet;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /assets_inlet_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://assets_inlet_auth/graphql;
    }
attr_modeling:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream attr_modeling {
      server attr-modeling:8080;
    }
    upstream attr_modeling_auth {
      server server:8080;
    }
  proxy_locations: |
    location /attr-modeling {
      auth_request /attr_modeling_auth;
      proxy_pass http://attr_modeling;
      proxy_redirect   off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /attr_modeling_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://attr_modeling_auth/graphql;
    }
auth:
  enabled: false
auth_proxy:
  enabled: false
  nginx_conf: ""
  proxy_upstreams: |
    upstream auth-proxy {
      server auth-proxy;
    }
  proxy_locations: |
    location /engine-rest {
      proxy_pass http://auth-proxy;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location /camunda {
      proxy_pass http://auth-proxy;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
backup:
  version: "1.0"
  enabled: false
  suspend: false
  schedule: "0 0 * * 0"
  server: backup
camunda:
  enabled: false
  mailer:
    args: []
    auth: ""
  graphql:
    args: []
    auth: ""
camunda2:
  enabled: false
  camunda_version: "7.20.0" # camunda/camunda-bpm-platform tag
  postgress_version: "16"
  api_version: "0.1.0" # camunda-api tag
  camunda_db: "postgres" # postgres | mysql
  proxy_upstreams: |
    upstream camunda {
      server camunda:8080;
    }
    upstream camunda_api {
      server camunda-api:4002;
    }
  proxy_locations: |
    location /camunda {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://camunda;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "base-uri script-src 'self' 'unsafe-inline' ajax.cloudflare.com;";
    }
    location /engine-rest {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://camunda;
    }
    location /camunda-api {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_pass http://camunda_api;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
  router_config: |
    camunda2: { routing_url: http://camunda-api:4002/, schema: { subgraph_url: http://camunda-api:4002/ } }
clearml:
  enabled: false
  clearml_proxy_locations: |
    location / {
      proxy_pass http://clearml-webserver:8080;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_read_timeout 600;
    }
pim20_data_loader:
  enabled: true
  version: "0.5.0"
  # codes_generator_version: ""
  proxy_upstreams: |
    upstream pim20_data_loader {
      server pim20-data-loader:8080;
    }
    upstream pim20_data_loader_auth {
      server server:8080;
    }

    upstream pim20_codes_generator {
      server pim20-codes-generator:8080;
    }
    upstream pim20_codes_generator_auth {
      server server:8080;
    }
  proxy_locations: |
    location /data_loader {
      auth_request /data_loader_auth;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://pim20_data_loader;
    }
    location /data_loader_auth {
      internal;
      proxy_method POST;
      proxy_set_body '{"query": "{}"}';
      proxy_set_header content-type "application/json";
      proxy_pass http://pim20_data_loader_auth/graphql;
    }

    location /codes_generator {
      auth_request /codes_generator_auth;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://pim20_codes_generator;
    }
    location /codes_generator_auth {
      internal;
      proxy_method POST;
      proxy_set_body '{"query": "{}"}';
      proxy_set_header content-type "application/json";
      proxy_pass http://pim20_codes_generator_auth/graphql;
    }
  codes_generator_version: "0.1.0"
classifier:
  enabled: false
  proxy_upstreams: |
    upstream classifier {
      server classifier:5000;
    }
  proxy_locations: |
    location /classify {
      proxy_pass http://classifier;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location /generate {
      proxy_pass http://classifier;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
      rewrite  ^/grafana/(.*) /$1 break;
    }
coder_postgresql:
  fullnameOverride: coder-postgresql
  auth:
    username: coder
    password: coder
    database: coder
  primary:
    persistence:
      existingClaim: customer-data
      subPath: data/coder-postgresql
  readReplicas:
    persistence:
      existingClaim: customer-data
      subPath: data/coder-postgresql
  volumePermissions:
    enabled: true
coder:
  enabled: true
  version: "3.0.1"
  #      auth_request /coder_auth;
  coder_proxy_locations: |
    location / {
      proxy_pass http://coder:80;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_read_timeout 600;
    }
  proxy_locations: |
    location ~ ^/pyservice/([^/]+)(.*) {
      set $service_id $1;
      set $params $2;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      auth_request /pyservice_auth;
      proxy_pass http://pyservice-$service_id.$(NAMESPACE).svc.cluster.local:8080;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
      error_page 502 = @pyservice_not_found;
    }
    location @pyservice_not_found {
      internal;
      set $coder_link coder-$host; #
      default_type text/html;
      return 200 '
        <html>
        <head>
          <title>Service Not Found</title>
          <style>
            body {
              font-family: Arial, sans-serif;
              color: #333;
              background-color: #f4f4f4;
              display: flex;
              justify-content: center;
              align-items: center;
              height: 100vh;
              margin: 0;
            }
            .container {
              background: #fff;
              padding: 20px 40px;
              border-radius: 8px;
              box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
              text-align: center;
            }
            h1 {
              color: #d9534f;
              margin-bottom: 20px;
            }
            .notebook-name {
              color: #d9534f;
              font-weight: bold;
            }
            a {
              color: #0275d8;
              text-decoration: none;
            }
            a:hover {
              text-decoration: underline;
            }
          </style>
        </head>
        <body>
          <div class="container">
            <h1>Service Not Found</h1>
            <p>Service for <span class="notebook-name">$service_id</span> not found</p>
            <p>It was probably not created, failed, or just stopped.</>
            <p>Visit your coder environment at <a href="https://$coder_link">https://$coder_link</a></p>
          </div>
        </body>
        </html>';
    }
    location /coder {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_pass http://sync-coder-service:8082;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  sync_coder:
    image: goalprofit/sync-coder
    version: "0.7.0"
  coder:
    image:
      repo: "goalprofit/coder"
      tag: "3.0.1"
      pullPolicy: Always
      pullSecrets:
        - name: regcred
    volumes:
      - name: customer
        hostPath:
          path: /data/ap-dev
          type: Directory
    volumeMounts:
      - name: customer
        mountPath: /home/coder/customer
        subPath: data/coder
    env:
      - name: TF_VAR_COOKIE_SESSION_NAME
        value: _hyd
      - name: TF_VAR_customer
        value: ap-dev
      - name: TF_VAR_CUSTOMER_VOLUME_CONFIG
        value: "{ \"hostPath\": { \"path\": \"/data/ap-dev\", \"type\": \"Directory\" } }"
      - name: CODER_PG_CONNECTION_URL
        value: "postgres://coder:coder@coder-postgresql:5432/coder?sslmode=disable"
      - name: CODER_ACCESS_URL
        value: https://coder-ap-dev.digitalwavetechnology.com
        #    envUseClusterAccessURL: false
      - name: CODER_OIDC_ISSUER_URL
        value: "https://api.mpin.io"
      - name: CODER_OIDC_EMAIL_DOMAIN
        value: "digitalwavetechnology.com"
      - name: CODER_OIDC_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: coder-oidc
            key: client_id
            optional: true
      - name: CODER_OIDC_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: coder-oidc
            key: client_secret
            optional: true
      - name: CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
        value: "true"
      - name: CODER_ENABLE_TERRAFORM_DEBUG_MODE
        value: "true"
      - name: CODER_TRACE_ENABLE
        value: "true"
      - name: CODER_TRACE_LOGS
        value: "true"
    service:
      type: ClusterIP
    serviceAccount:
      extraRules:
        - apiGroups: [""]
          resources: ["services"]
          verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
        - apiGroups: [""]
          resources: ["secrets"]
          verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
  ingress:
    enable: false
  superAdmin:
    # Options for configuring the secret used to specify the password for the
    # built-in super admin account.
    passwordSecret:
      # coderd.superAdmin.passwordSecret.name -- Name of a secret that should
      # be used to determine the password for the super admin account. The
      # password should be contained in the field `password`, or the manually
      # specified one.
      name: "coder-superadmin"
      # coderd.superAdmin.passwordSecret.key -- The key of the secret that
      # contains the super admin password.
      key: "password"
#coder_logstream_kube:
#  url: https://coder.product-dev.digitalwavetechnology.com
ai:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream ai {
      server ai:8080;
    }
  proxy_locations: |
    location /generate {
      proxy_pass http://ai;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location /ai {
      proxy_pass http://ai;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location ~* ^/socket.io/ {
      proxy_pass http://ai;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_buffering off;
    }
assistant:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream assistant {
      server assistant:8080;
    }
    upstream assistant_auth {
      server server:8080;
    }
  proxy_locations: |
    location /assistant {
        auth_request /assistant_auth;
        proxy_pass http://assistant;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /assistant_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://assistant_auth/graphql;
    }
comp:
  enabled: false
cron:
  enabled: false
cronjobs:
  enabled: false
debug:
  version: "1.0"
  enabled: true
download:
  enabled: false
  schedule: "0 * * * *"
  suspend: false
  image: download:latest
  env: ""
front:
  version: "2.14-po"
  enabled: true
image_converter:
  version: latest
  enabled: false
export_mail:
  version: latest
  enabled: false
lftp_mirror:
  enabled: false
  version: "1.0"
  schedule: "0 * * * *"
  suspend: false
  ftp_url: ""
  local_url: /in
  ftp_folder: ""
mail:
  enabled: false
  ssmtp_config_path: /data/ssmtp.conf
mdc_converter:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream mdc_converter {
      server mdc-converter:5000;
    }
  proxy_locations: |
    location /mdc {
      proxy_pass http://mdc_converter;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
modeling:
  enabled: false
  image: goalprofit/modeling
  suspend: false
  cluster: modeling
  region: europe-west1
  s3_storage_endpoint: https://storage.googleapis.com
miracl:
  enabled: true
  version: "2.1"
  client_id: xxx
  client_secret: xxx
  pin_auth_method_path: /miracl?state
  pin_auth_method_title: Login with PIN
  adfs_auth_method_path: /miracl/saml
  adfs_auth_method_title: Login with ADFS
  proxy_upstreams: |
    upstream miracl {
      server miracl:8000;
    }
  proxy_locations: |
    location /miracl {
      proxy_pass http://miracl;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
mysql:
  enabled: false
  url: amazonaws.com
  host: com
  ram_limit: 10Ti
opportunity_cost:
  enabled: false
  schedule: "0 3 * * 6"
  strategy: system_cost_opportunity
  instant_lag: 0
  delayed_lag: 7
  date: ""
optimization:
  enabled: false
  version: "2.1"
  num_cpus: 64
optimizationmd:
  enabled: false
packman:
  version: latest
  enabled: false
  proxy_upstreams: |
    upstream packman {
      server packman:9091;
    }
  proxy_locations: |
    location /packman {
      proxy_pass http://packman;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
pimml:
  enabled: false
  url: https://pimml.goalprofit.com
pim_attr_link_generator:
  version: "1.0"
  enabled: false
  schedule: "0 * * * *"
pim_token_update:
  version: "1.0"
  enabled: false
  schedule: "0 0 * * *"
pimsync:
  version: "1.0"
  enabled: false
  proxy_upstreams: |
    upstream pimsync {
      server pimsync:8080;
    }
  proxy_locations: |
    location /pimsync {
      proxy_pass http://pimsync;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
dynamic_proxy:
  image: nginx
  version: 1.25.5
  enabled: true
  port: 30000
  proxy_locations: |
    location / {
      proxy_pass http://dynamic-proxy;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_read_timeout 600;
    }
proxy:
  image: nginx
  version: 1.25.5
  enabled: true
  port: 30045
  proxy_locations: |
    location @default_403 {
      internal;
      default_type text/html;
      return 403 '
        <!DOCTYPE html>
        <html lang="en">
        <head>
          <meta charset="UTF-8">
          <meta name="viewport" content="width=device-width, initial-scale=1.0">
          <title>403 Forbidden</title>
          <style>
            body {
              font-family: Arial, sans-serif;
              background-color: #f4f4f4;
              color: #333;
              display: flex;
              justify-content: center;
              align-items: center;
              height: 100vh;
              margin: 0;
            }
            .container {
              background: white;
              padding: 30px;
              border-radius: 8px;
              box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
              text-align: center;
            }
            h1 {
              font-size: 24px;
              margin-bottom: 16px;
              color: #d9534f;
            }
            p {
              font-size: 16px;
              margin-bottom: 24px;
            }
            .btn {
              display: inline-block;
              padding: 10px 20px;
              font-size: 16px;
              color: white;
              background-color: #5bc0de;
              border: none;
              border-radius: 4px;
              text-decoration: none;
            }
            .btn:hover {
              background-color: #31b0d5;
            }
          </style>
        </head>
        <body>
          <div class="container">
            <h1>403 Forbidden</h1>
            <p>Access denied. You do not have the necessary permissions to access this resource.</p>
            <a href="/" class="btn">Return to Home</a>
          </div>
        </body>
        </html>';
    }
    location @default_401 {
      internal;
      default_type text/html;
      return 401 '
        <!DOCTYPE html>
        <html lang="en">
        <head>
          <meta charset="UTF-8">
          <meta name="viewport" content="width=device-width, initial-scale=1.0">
          <title>401 Unauthorized</title>
          <style>
            body {
              font-family: Arial, sans-serif;
              background-color: #f4f4f4;
              color: #333;
              display: flex;
              justify-content: center;
              align-items: center;
              height: 100vh;
              margin: 0;
            }
            .container {
              background: white;
              padding: 30px;
              border-radius: 8px;
              box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
              text-align: center;
            }
            h1 {
              font-size: 24px;
              margin-bottom: 16px;
              color: #d9534f;
            }
            p {
              font-size: 16px;
              margin-bottom: 24px;
            }
            .btn {
              display: inline-block;
              padding: 10px 20px;
              font-size: 16px;
              color: white;
              background-color: #5bc0de;
              border: none;
              border-radius: 4px;
              text-decoration: none;
            }
            .btn:hover {
              background-color: #31b0d5;
            }
          </style>
        </head>
        <body>
          <div class="container">
            <h1>401 Unauthorized</h1>
            <p>Not Authorized. You need to log in to access this resource.</p>
            <a href="/" class="btn">Return to Home</a>
          </div>
        </body>
        </html>';
    }
    location /authenticator/login {
      proxy_pass http://authenticator;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location @auth-check-failed {
      return 302 $scheme://$host/authenticator/login?redirect=$request_uri;
    }
    location /auth-check-basic {
      internal;
      proxy_method GET;
      proxy_pass http://authenticator/authenticator/check-basic;
    }
retail:
  image: docker.io/goalprofit/retail
  version: "1.7.0"
  enabled: true
  #optimization_url: https://optimization-zt5m454lvq-uc.a.run.app
  optimization_url: https://us-central1-mindful-phalanx-313619.cloudfunctions.net/optimization_google_function_v1
  optimizationmd_url: https://62lrdxjimdkwo5mbliuppiaequ0gdzin.lambda-url.eu-west-3.on.aws
  optimizationmeta_url: http://optimization:5000
retail_restart:
  enabled: false
  schedule: "0 10 * * *"
save:
  enabled: true
scrapper:
  enabled: false
  proxy_upstreams: |
    upstream scrapper {
      server scrapper:3000;
    }
  proxy_locations: |
    location /scrap {
      proxy_pass http://scrapper;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
server:
  image: docker.io/goalprofit/core
  version: "1.8.1"
  enabled: true
  port: 30000
  ram_limit: 100Gi
  enabled_orm: false
  orm_graphiql_endpoint: /orm
  proxy_locations: ""
  mysql_slave_index: 0
server_api:
  enabled: true
  replicas: 1
  version: "6.9.2"
  query_cores: 16
  query_time_logging: 0
  query_logging: 0
  codes_in_chunk: 100
  olap_timeout: 600000
  node_max_old_space_size: 16384
  debug: false
  proxy_upstreams: |
    upstream server_api {
      server server-api:8080;
    }
    upstream server_api_auth {
      server server:8080;
    }
  proxy_locations: |
    location /server-api {
        auth_request /server_api_auth;
        proxy_pass http://server_api;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /server_api_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://server_api_auth/graphql;
    }
  router_config: |
    server-api: { routing_url: http://server-api:8080/, schema: { subgraph_url: http://server-api:8080/ } }
pages_server:
  enabled: false
  version: "0.2"
  proxy_upstreams: |
    upstream dev {
      server pages-server:8080;
    }
    upstream dev_auth {
      server server:8080;
    }
  proxy_locations: |
    location /pages {
        auth_request /dev_auth;
        proxy_pass http://dev;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /dev_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://dev_auth/graphql;
    }
temperature_forecast:
  version: latest
  enabled: false
  suspend: false
  schedule: "0 0 * * 0"
jupyter:
  enabled: false
  version: "1.2"
  ram_limit: 10Gi
voila:
  enabled: false
  version: "1.0"
  ram_limit: 10Ti
  proxy_upstreams: |
    upstream voila {
      server voila:8866;
    }
    upstream voila_auth {
      server server:8080;
    }
  proxy_locations: |
    location /voila {
      try_files /nonexistent @voila_$http_upgrade;
    }
    location @voila_websocket {
      proxy_pass http://voila;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location @voila_ {
      auth_request /voila_auth;
      proxy_pass http://voila;
      proxy_redirect   off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
    }
    location /voila_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://voila_auth/graphql;
    }
solara:
  enabled: false
  proxy_locations: |
    location ~ ^/solara/([^/]+)(.*) {
      set $notebook $1;
      set $params $2;
      rewrite ^/solara/([^/\?]+)\?(.*)$ /solara/$1/?$2 permanent;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      auth_request /solara_auth;
      proxy_pass http://solara-$notebook.$(NAMESPACE).svc.cluster.local:8765;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
      error_page 502 = @solara_notebook_not_found;
    }
    location @solara_notebook_not_found {
      internal;
      set $coder_link coder-$host; #
      default_type text/html;
      return 200 '
        <html>
        <head>
          <title>Service Not Found</title>
          <style>
            body {
              font-family: Arial, sans-serif;
              color: #333;
              background-color: #f4f4f4;
              display: flex;
              justify-content: center;
              align-items: center;
              height: 100vh;
              margin: 0;
            }
            .container {
              background: #fff;
              padding: 20px 40px;
              border-radius: 8px;
              box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
              text-align: center;
            }
            h1 {
              color: #d9534f;
              margin-bottom: 20px;
            }
            .notebook-name {
              color: #d9534f;
              font-weight: bold;
            }
            a {
              color: #0275d8;
              text-decoration: none;
            }
            a:hover {
              text-decoration: underline;
            }
          </style>
        </head>
        <body>
          <div class="container">
            <h1>Service Not Found</h1>
            <p>Solara service for <span class="notebook-name">$notebook</span> not found</p>
            <p>It was probably not created, failed, or just stopped.</>
            <p>Visit your coder environment at <a href="https://$coder_link">https://$coder_link</a></p>
          </div>
        </body>
        </html>';
    }
    location /solara_auth {
      internal;
      proxy_method GET;
      proxy_pass http://access-control/access-control/check-basic;
    }
solara1:
  enabled: false
  version: "1.1"
  proxy_upstreams: |
    upstream solara {
      server solara:8765;
    }
    upstream solara_auth {
      server server:8080;
    }
  proxy_locations: |
    location /solara {
      try_files /nonexistent @solara_$http_upgrade;
    }
    location @solara_websocket {
      proxy_pass http://solara;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
    location @solara_ {
      proxy_redirect   off;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      auth_request /solara_auth;
      proxy_pass http://solara;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Script-Name /solara;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
    }
    location /solara_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://solara_auth/graphql;
    }
streamlit:
  version: dev
  enabled: false
  proxy_upstreams: |
    upstream streamlit {
      server streamlit:8501;
    }
  proxy_locations: |
    location /streamlit {
      proxy_pass http://streamlit;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
sync:
  enabled: false
webjobs:
  enabled: false
  proxy_upstreams: |
    upstream webjobs {
      server webjobs:8082;
    }
  proxy_locations: |
    location /webjobs {
      proxy_pass http://webjobs;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_read_timeout 600;
    }
  config: {}
work:
  enabled: false
loki:
  enabled: true
  access_control: check-basic
  fullnameOverride: loki
  loki:
    auth_enabled: false
    storage_config:
      boltdb_shipper:
        active_index_directory: /data/loki/index
    storage:
      type: filesystem
      filesystem:
        chunks_directory: /data/loki/chunks
        rules_directory: /data/loki/rules
        admin_api_directory: /data/loki/admin
      bucketNames: {}
    commonConfig:
      replication_factor: 1
      path_prefix: /data/loki
    schemaConfig:
      configs:
        - from: 2024-04-01
          store: boltdb-shipper
          object_store: filesystem
          schema: v13
          index:
            prefix: loki_index_
            period: 24h
    limits_config:
      allow_structured_metadata: false
      reject_old_samples_max_age: 336h
    ingester:
      chunk_encoding: snappy
    tracing:
      enabled: true
    querier:
      max_concurrent: 2
    compactor:
      working_directory: /data/loki/compactor
      compaction_interval: 10m
      retention_enabled: true
      retention_delete_delay: 2h
      retention_delete_worker_count: 150
      delete_request_store: filesystem
  deploymentMode: SingleBinary
  singleBinary:
    replicas: 1
    resources:
      limits:
        cpu: 3
        memory: 4Gi
      requests:
        cpu: 2
        memory: 2Gi
    extraEnv:
      - name: GOMEMLIMIT
        value: 3750MiB
    persistence:
      enableStatefulSetAutoDeletePVC: false
      enabled: false
    extraVolumeMounts:
      - name: loki-storage
        mountPath: /data/loki
        subPath: data/loki-stack
    extraVolumes:
      - name: loki-storage
        hostPath:
          path: /data/ap-dev
          type: Directory
    readOnlyRootFilesystem: false
    containerSecurityContext:
      allowPrivilegeEscalation: true
      readOnlyRootFilesystem: false
    affinity: {}
  test:
    enabled: false
  lokiCanary:
    enabled: false
  minio:
    enabled: false
  gateway:
    enabled: false
  resultsCache:
    enabled: false
  chunksCache:
    enabled: false
  backend:
    replicas: 0
  read:
    replicas: 0
  write:
    replicas: 0
  ingester:
    replicas: 0
  querier:
    replicas: 0
  queryFrontend:
    replicas: 0
  queryScheduler:
    replicas: 0
  distributor:
    replicas: 0
  compactor:
    replicas: 0
  indexGateway:
    replicas: 0
  bloomCompactor:
    replicas: 0
  bloomGateway:
    replicas: 0
promtail:
  enabled: true
  fullnameOverride: promtail
  config:
    clients:
      - url: http://loki:3100/loki/api/v1/push
    snippets:
      extraRelabelConfigs:
        - source_labels: [__meta_kubernetes_namespace]
          regex: ap-dev
          action: keep
grafana:
  enabled: true
  fullnameOverride: grafana
  image:
    tag: 11.3.1
  rbac:
    create: false
    pspEnabled: false
    namespaced: true
  adminUser: admin
  adminPassword: admin
  grafana.ini:
    users:
      viewers_can_edit: false
    auth.anonymous:
      enabled: true
      org_role: Admin
    database:
      wal: false
    server:
      root_url: "%(protocol)s://%(domain)s/grafana"
      serve_from_sub_path: true
  persistence:
    enabled: true
  proxy_upstreams: |
    upstream grafana {
      server grafana;
    }
  proxy_locations: |
    location /grafana {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      error_page 403 = @default_403;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://grafana;
    }
prometheus:
  enabled: true
  fullnameOverride: prometheus
  prometheus-node-exporter:
    enabled: true
    fullnameOverride: prometheus-node-exporter
    service:
      hostPort: 9091
  alertmanager:
    enabled: true
    fullnameOverride: alertmanager
  server:
    enabled: true
    fullnameOverride: prometheus-server
    extraFlags:
      - "web.enable-lifecycle"
      - "web.route-prefix=/"
      - "web.external-url=https://ap-dev.digitalwavetechnology.com/prometheus"
  prometheus-pushgateway:
    enabled: true
    fullnameOverride: prometheus-pushgateway
  kube-state-metrics:
    fullnameOverride: kube-state-metrics
  extraScrapeConfigs: |
    - job_name: server
      metrics_path: /metrics
      static_configs:
        - targets:
          - server:8080
  proxy_upstreams: |
    upstream prometheus {
      server prometheus-server;
    }
  proxy_locations: |
    location /prometheus {
      return 301 https://ap-dev.digitalwavetechnology.com/prometheus/;
    }
    location /prometheus/ {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      error_page 403 = @default_403;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://prometheus/;
    }
loki_stack:
  enabled: false
  loki:
    enabled: false
  promtail:
    enabled: false
  prometheus:
    enabled: false
  grafana:
    enabled: false
    sidecar:
      enabled: false
pypi_server:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream pypi-server {
      server pypi-server:8080;
    }
  proxy_locations: |
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://pypi-server;
    }
downloads:
  enabled: false
  version: "1.0"
  proxy_upstreams: |
    upstream downloads {
      server downloads:8080;
    }
    upstream downloads_auth {
      server server:8080;
    }
  proxy_locations: |
    location /downloads {
        auth_request /downloads_auth;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        rewrite ^/downloads/(.*)$ /$1 break;
        proxy_pass http://downloads;
    }
    location /downloads_auth {
      internal;
      proxy_method POST;
      proxy_set_body '{"query": "{}"}';
      proxy_set_header content-type "application/json";
      proxy_pass http://downloads_auth/graphql;
    }
jupyterhub:
  enabled: true
  version: "1.1.3"
  access_control: check-basic
  proxy_upstreams: |
    upstream jupyterhub {
      server jupyterhub-proxy-public:80;
    }
    upstream jupyterhub_auth {
      server server:8080;
    }
  proxy_locations: |
    location /jupyterhub {
      try_files /nonexistent @jupyterhub_$http_upgrade;
    }
    location @jupyterhub_websocket {
      proxy_pass http://jupyterhub;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location @jupyterhub_ {
      proxy_pass http://jupyterhub;
      auth_request /jupyterhub_auth;
      error_page 401 = @default_401;
      error_page 403 = @default_403;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
      add_header "Access-Control-Allow-Origin" "*";
      add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS";
      add_header "Access-Control-Allow-Headers" "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range";
      add_header "Access-Control-Expose-Headers" "Content-Length,Content-Range";
    }

    location /jupyterhub_auth {
      internal;
      proxy_method GET;
      proxy_set_header content-type "application/json";
      proxy_pass http://access-control/access-control/check-basic;
    }
jupyterhub_internal:
  fullnameOverride: jupyterhub
  proxy:
    service:
      type: ClusterIP
  singleuser:
    image:
      #      name: quay.io/jupyter/datascience-notebook
      #      tag: "2023-11-06"
      name: goalprofit/jupyterhub
      tag: 1.1.3
      pullSecrets:
        - name: regcred
      pullPolicy: Always
    cmd: jupyterhub-singleuser --help
    networkPolicy:
      enabled: false
    cloudMetadata:
      blockWithIptables: false
    extraEnv:
      CUSTOMER: ap-dev
      COOKIE_SESSION_NAME: _hyd
      SERVICE_LOGIN:
        valueFrom:
          secretKeyRef:
            name: secret-service
            key: username
      SERVICE_PASSWORD:
        valueFrom:
          secretKeyRef:
            name: secret-service
            key: password
      OPENAI_API_KEY:
        valueFrom:
          secretKeyRef:
            name: secret-openai
            key: key
      JI_API_KEY:
        valueFrom:
          secretKeyRef:
            name: secret-ji
            key: key
            optional: true
    storage:
      extraVolumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "azure-kvname-user-msi"
      extraVolumeMounts:
        - name: secrets-store01-inline
          mountPath: /mnt/secrets-store
  hub:
    baseUrl: /jupyterhub
    config:
      Authenticator:
        #        admin_users:
        #          - adminuser1
        #          - adminuser2
        auto_login: true
    extraEnv:
      CUSTOMER: ap-dev
      COOKIE_SESSION_NAME: _hyd
      COOKIE_SESSION_KEY:
        valueFrom:
          secretKeyRef:
            name: cookie-session
            key: key
      SERVICE_LOGIN:
        valueFrom:
          secretKeyRef:
            name: secret-service
            key: username
      SERVICE_PASSWORD:
        valueFrom:
          secretKeyRef:
            name: secret-service
            key: password
    extraVolumes:
      - name: customer
        hostPath:
          path: /data/ap-dev
          type: Directory
    extraVolumeMounts:
      - name: customer
        mountPath: /data
        subPath: data/jupyter/hub
    extraConfig:
      names_servers: |
        c.JupyterHub.allow_named_servers = False
      myExtraConfig: |
        # stub written from memory, beware of errors
        c.Authenticator.enable_auth_state = True
        c.Authenticator.refresh_pre_spawn = True
        from jupyterhub.auth import Authenticator
        from http.cookies import SimpleCookie
        import base64
        import json
        import sys
        import jwt
        print("!!!!!!!!!!!!!!!!!!!!!!")
        class MyCustomAuth(Authenticator):
          async def authenticate(self, handler, data):
            print("===============")
            print(handler.request.cookies)
            try:
              session_cookie = handler.request.cookies.get(os.environ.get("COOKIE_SESSION_NAME")).value
              print(f"session_cookie={session_cookie}")
              secret_key = base64.b64decode(os.environ.get("COOKIE_SESSION_KEY"))
              payload = jwt.decode(session_cookie, secret_key, algorithms=['HS256'])
              print(f"authenticate complete {payload.get('sub')}", file=sys.stderr)
              return {
                "name": payload['sub'],
                "auth_state": {
                  "cookie_session": session_cookie
                }
              }
            except Exception as e:
              print(f"authenticate failed: {e}", file=sys.stderr)
              return None
          #async def refresh_user(self, user, handler=None):
          #  session_cookie = handler.request.cookies.get(os.environ.get("COOKIE_SESSION_NAME")).value
          #  auth_state = await user.get_auth_state()
          #  auth_state = auth_state if auth_state else {}
          #  print(f"REFRESH_USER state_cookie/current_cookie=\n{auth_state.get('cookie', '')}\n{session_cookie}")
          #  return session_cookie == auth_state.get("cookie", '')

          async def pre_spawn_start(self, user, spawner):
            auth_state = await user.get_auth_state()
            spawner.environment['COOKIE_SESSION'] = auth_state['cookie_session']
            print(f"PRE_SPAWN_START auth_state={auth_state}")

        from kubespawner import KubeSpawner
        import os
        import json
        import yaml
        class MyCustomSpawner(KubeSpawner):
            def start(self):
                username = self.user.name
                customer = os.getenv('CUSTOMER')
                os.makedirs(os.path.join("/data/common", ".ssh"), exist_ok=True)
                os.makedirs(os.path.join("/data/users", username, ".ssh"), exist_ok=True)
                customer_volume_str = "\n\n\nhostPath:\n  path: /data/ap-dev\n  type: Directory\n\n\n"
                customer_volume = yaml.safe_load(customer_volume_str)
                customer_volume['name'] = 'customer'
                self.volumes = [customer_volume]
                self.volume_mounts = [{
                    'name': 'customer',
                    'subPath': f'data/jupyter/hub/users/{username}',
                    'mountPath': '/notebooks/src'
                #}, {
                #    'name': 'customer',
                #    'subPath': f'data/jupyter/hub/common',
                #    'mountPath': '/notebooks/common',
                #    'readOnly': True
                }, {
                    'name': 'customer',
                    'subPath': f'data/downloads',
                    'mountPath': '/downloads'
                }]
                return super().start()
        c.JupyterHub.spawner_class = MyCustomSpawner
        c.JupyterHub.authenticator_class = MyCustomAuth
        c.JupyterHub.cookie_max_age_days = 1
        c.Spawner.notebook_dir = "/notebooks"
stakater:
  enabled: true
jaeger:
  enabled: false
  fullnameOverride: jaeger
  allInOne:
    enabled: true
    extraEnv:
      - name: QUERY_BASE_PATH
        value: /tracing
    args:
      - "--collector.otlp.grpc.max-message-size=8388608"
      - "--memory.max-traces=1000"
    resources:
      limits:
        cpu: 500m
        memory: 2048Mi
      requests:
        cpu: 256m
        memory: 1024Mi
  query:
    basePath: /tracing
    service:
      port: 16686
    enabled: false
  collector:
    service:
      otlp:
        grpc:
          name: "otlp-grpc"
          port: 4317
        http:
          name: "otlp-http"
          port: 4318
    enabled: false
  proxy_upstreams: |
    upstream jaeger_query {
      server jaeger-query:16686;
    }
    upstream jaeger_query_auth {
      server server:8080;
    }
  proxy_locations: |
    location /tracing {
        auth_request /tracing_auth;
        proxy_pass http://jaeger_query;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 600;
    }
    location /tracing_auth {
      internal;
      proxy_method POST;
      proxy_set_header content-type "application/json";
      proxy_set_body '{"query": "{}"}';
      proxy_pass http://jaeger_query_auth/graphql;
    }
  provisionDataStore:
    cassandra: false
  storage:
    type: "memory"
  agent:
    enabled: false
matrix-synapse:
  enabled: false
  fullnameOverride: matrix-synapse
  image:
    repository: matrixdotorg/synapse
    pullPolicy: Always
    pullSecrets:
      - name: regcred
  serverName: ap-dev.digitalwavetechnology.com
  publicServerName: ap-dev.digitalwavetechnology.com
  config:
    registrationSharedSecret: "9oB1Ptc7zSsh:MfSp2;OMDvwO1@=8F-yL~oX#N*GPEUYDT,Cil" # TODO: get from secret
  extraConfig:
    auto_join_rooms:
      - "#pim:ap-dev.digitalwavetechnology.com"
  ingress:
    enabled: false
  postgresql:
    enabled: true
    auth:
      # XXX Change me!
      password: synapse
      sentinel: false
      ## Or use existing secret with "password" key
      ## instead of static password
      ##
      # existingSecret: postgresql-secret
      username: synapse
      database: synapse
    primary:
      persistence:
        existingClaim: customer-data
        subPath: data/matrix-synapse-postgresql
    volumePermissions:
      enabled: true
  persistence:
    existingClaim: matrix-synapse-data
  redis:
    enabled: true
    ## Database ID for non-default database
    # dbid: 0
    sentinel:
      masterService:
        enabled: false
    auth:
      enabled: true
      # XXX Change me!
      password: synapse
      ## Or use existing secret with "redis-password" key
      ## instead of static password
      ##
      # existingSecret: redis-secret
  proxy_upstreams: |
    upstream matrix {
      server matrix-synapse:8008;
    }
  proxy_locations: |
    location /_synapse/admin {
      proxy_pass http://matrix;
      proxy_redirect   off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
    }
    location /_synapse/client {
      try_files /nonexistent @synapse_$http_upgrade;
    }
    location @synapse_websocket {
      proxy_pass http://matrix;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location @synapse_ {
      proxy_pass http://matrix;
      proxy_redirect   off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
    }
    location /_matrix {
      try_files /nonexistent @matrix_$http_upgrade;
    }
    location @matrix_websocket {
      proxy_pass http://matrix;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_read_timeout 600;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location @matrix_ {
      proxy_pass http://matrix;
      proxy_redirect   off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host;
      proxy_hide_header Content-Security-Policy;
      add_header Content-Security-Policy "frame-ancestors 'self' https://*.digitalwavetechnology.com https://*.goalprofit.com";
    }
loki_pruner:
  enabled: false
  version: "1.0.0"
  max_size: "10G"
  target_dir: "/work"
  schedule: "0 * * * *"
pod_reloader:
  enabled: true
  version: "1"
reloader:
  enabled: true
  fullnameOverride: reloader
server_api_redis:
  enabled: true
  fullnameOverride: "server-api-redis"
  master:
    resources:
      requests:
        cpu: "1.0"
        memory: "3072Mi"
        ephemeral-storage: "50Mi"
      limits:
        cpu: "3.0"
        memory: "6144Mi"
        ephemeral-storage: "2Gi"
  replica:
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
        ephemeral-storage: "50Mi"
      limits:
        cpu: "150m"
        memory: "192Mi"
        ephemeral-storage: "2Gi"
orm:
  enabled: false
  version: "1.0.0"
  replicas: 1
  ram_limit: 10Ti
  proxy_locations: |
    location /api/v1 {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_pass http://orm;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_read_timeout 600;
    }
    location /api/v2 {
      auth_request /auth-check-basic;
      error_page 401 = @auth-check-failed;
      proxy_pass http://orm;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_read_timeout 600;
    }
namespace: ap-dev
postgresql:
  enabled: true
  persistence:
    enabled: true
    size: 8Gi
    storageClass: "hostpath-customer-volume"
    accessModes:
      - ReadWriteOnce
