# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

## Dependencies configuration parameters

## Redis dependency parameters

# -- Install redis as a depending chart
redisDependencyEnabled: true
# -- Install mariadb as a depending chart
mariadbDependencyEnabled: true
# -- Install postgresql as a depending chart
postgresqlDependencyEnabled: false

# Configure postgresql as a dependency chart
# postgresql:
#  global:
#    security:
#      # -- Allow insecure images on bitnami charts. Required as per when  using bitnamilegacy https://github.com/bitnami/charts/issues/30850
#      allowInsecureImages: true
#  image:
#    # -- Pin PostgreSQL image to bitnamilegacy image repository.
#    repository: bitnamilegacy/postgresql
#  auth:
#    # -- Configure postgresql auth username
#    username: CHANGEME
#    # -- Configure postgresql auth password
#    password: CHANGEME
#    # -- Configure postgresql auth database
#    database: passbolt

global:
  imageRegistry: ""
  imagePullSecrets: []

# Configure redis dependency chart
redis:
  global:
    security:
      # -- Allow insecure images on bitnami charts. Required as per when  using bitnamilegacy https://github.com/bitnami/charts/issues/30850
      allowInsecureImages: true
  image:
    # -- Pin redis image to bitnamilegacy image repository.
    repository: bitnamilegacy/redis
  auth:
    # -- Enable redis authentication
    enabled: true
    # -- Configure redis password
    password: "CHANGEME"
  sentinel:
    image:
      # -- Pin redis-sentinel image to bitnamilegacy image repository.
      repository: bitnamilegacy/redis-sentinel
    # -- Enable redis sentinel
    enabled: true

## MariaDB dependency parameters

# Configure mariadb as a dependency chart
mariadb:
  global:
    security:
      # -- Allow insecure images on bitnami charts. Required as per when  using bitnamilegacy https://github.com/bitnami/charts/issues/30850
      allowInsecureImages: true
  image:
    # -- Pin redis image to bitnamilegacy image repository.
    repository: bitnamilegacy/mariadb
  # -- Configure mariadb architecture
  architecture: replication
  auth:
    # -- Configure mariadb auth root password
    rootPassword: root
    # -- Configure mariadb auth username
    username: pbadmin
    # -- Configure mariadb auth password
    password: DW"C_/9jTTkMjwj<'%
    # -- Configure mariadb auth database
    database: passboltdb
    # -- Configure mariadb auth replicationPassword
    replicationPassword: w(*4Ewj:m`K/Ai^/qb
  # -- Configure parameters for the primary instance.
  primary:
    # -- Configure persistence options.
    persistence:
      # -- Enable persistence on MariaDB primary replicas using a `PersistentVolumeClaim`. If false, use emptyDir
      enabled: true
      # -- Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas. When it's set the rest of persistence parameters are ignored.
      existingClaim: ""
      # -- Subdirectory of the volume to mount at
      subPath: ""
      # -- Primary persistent volume storage Class
      storageClass: ""
      # -- Labels for the PVC
      labels: {}
      # -- Primary persistent volume claim annotations
      annotations: {}
      # -- Primary persistent volume access Modes
      accessModes:
        - ReadWriteOnce
      # -- Primary persistent volume size
      size: 8Gi
      # -- Selector to match an existing Persistent Volume
      selector: {}
  # -- Configure parameters for the secondary instance.
  secondary:
    # -- Configure persistence options.
    persistence:
      # -- Enable persistence on MariaDB secondary replicas using a `PersistentVolumeClaim`. If false, use emptyDir
      enabled: true
      # -- Subdirectory of the volume to mount at
      subPath: ""
      # -- Secondary persistent volume storage Class
      storageClass: ""
      # -- Labels for the PVC
      labels: {}
      # -- Secondary persistent volume claim annotations
      annotations: {}
      # -- Secondary persistent volume access Modes
      accessModes:
        - ReadWriteOnce
      # -- Secondary persistent volume size
      size: 8Gi
      # -- Selector to match an existing Persistent Volume
      selector: {}

## Passbolt configuration

## Passbolt container and sidecar parameters
app:
  # -- Configure pasbolt deployment init container that waits for database
  databaseInitContainer:
    # -- Toggle pasbolt deployment init container that waits for database
    enabled: true
  # initImage:
  #   # -- Configure pasbolt deployment init container image client for database
  #   client: mariadb
  #  registry: ""
  #  # -- Configure pasbolt deployment image repsitory
  #  repository: mariadb
  #  # -- Configure pasbolt deployment image pullPolicy
  #  pullPolicy: IfNotPresent
  #  # -- Overrides the image tag whose default is the chart appVersion.
  #  tag: latest
  image:
    # -- Configure pasbolt deployment image repsitory
    registry: ""
    repository: passbolt/passbolt
    # -- Configure pasbolt deployment image pullPolicy
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    tag: 5.9.0-1-ce
  # Allowed options: mariadb, mysql or postgresql
  database:
    kind: mariadb
    # -- Configure ssl on mariadb/mysql clients
    # -- In case this is enabled, you will be responsible for creating and mounting the certificates and
    # -- additional configutions on both the client and the server.
    # ssl: off
  cache:
    # Use CACHE_CAKE_DEFAULT_* variables to configure the connection to redis instance
    # on the passboltEnv configuration section
    redis:
      # -- By enabling redis the chart will mount a configuration file on /etc/passbolt/app.php
      # That instructs passbolt to store sessions on redis and to use it as a general cache.
      enabled: true
      sentinelProxy:
        # -- Inject a haproxy sidecar container configured as a proxy to redis sentinel
        # Make sure that CACHE_CAKE_DEFAULT_SERVER is set to '127.0.0.1' to use the proxy
        enabled: true
        # -- Configure redis sentinel proxy image
        image:
          registry: ""
          # -- Configure redis sentinel image repository
          repository: haproxy
          # -- Configure redis sentinel image tag
          tag: "latest"
        # -- Configure redis sentinel container resources
        resources: {}
        # -- Configure the passbolt deployment resources
  extraPodLabels: {}
  resources: {}
  tls:
    # -- If autogenerate is true, the chart will generate a secret with a certificate for APP_FULL_BASE_URL hostname
    # -- if autogenerate is false, existingSecret should be filled with an existing tls kind secret name
    # @ignored
    autogenerate: true
    # existingSecret: ""
  # -- Configure additional containers to be added to the pod
  extraContainers: []

# -- Enable email cron
cronJobEmail:
  enabled: true
  schedule: "* * * * *"
  extraPodLabels: {}

## Passbolt environment parameters

# -- Pro subscription key in base64 only if you are using pro version
# subscriptionKey:
# -- Configure passbolt subscription key path
# subscription_keyPath: /etc/passbolt/subscription_key.txt

# -- Configure passbolt gpg directory
gpgPath: /etc/passbolt/gpg
# -- Gpg server private key in base64
gpgServerKeyPrivate: ""
# -- Gpg server public key in base64
gpgServerKeyPublic: ""
# -- Name of the existing secret for the GPG server keypair. The secret must contain the `serverkey.asc` and `serverkey_private.asc` keys.
gpgExistingSecret: ""

# -- Name of the existing secret for the JWT server keypair. The secret must contain the `jwt.key` and `jwt.pem` keys.
jwtExistingSecret: ""
# -- Configure passbolt jwt directory
jwtPath: /etc/passbolt/jwt
# -- JWT server private key in base64
jwtServerPrivate: ""
# -- JWT server public key in base64
jwtServerPublic: ""
# -- Forces overwrite JWT keys
jwtCreateKeysForced: false
jobCreateJwtKeys:
  extraPodLabels: {}

jobCreateGpgKeys:
  extraPodLabels: {}

passboltEnv:
  plain:

    # -- Configure passbolt privacy url
    PASSBOLT_LEGAL_PRIVACYPOLICYURL: https://www.passbolt.com/privacy
    # -- Configure passbolt fullBaseUrl
    APP_FULL_BASE_URL: https://passbolt.realm.local
    # -- Configure passbolt to force ssl
    PASSBOLT_SSL_FORCE: true
    # -- Toggle passbolt public registration
    PASSBOLT_REGISTRATION_PUBLIC: true
    # -- Configure passbolt cake cache server
    CACHE_DEFAULT_HOST: 127.0.0.1
    # -- Configure passbolt cake core cache server
    CACHE_CAKECORE_HOST: 127.0.0.1
    # -- Configure passbolt cake model cache server
    CACHE_CAKEMODEL_HOST: 127.0.0.1
    # -- Configure passbolt cake cache server port
    CACHE_DEFAULT_PORT: 6379
    # -- Configure passbolt cake core cache server port
    CACHE_CAKECORE_PORT: 6379
    # -- Configure passbolt cake model cache server port
    CACHE_CAKEMODEL_PORT: 6379
    # -- Configure passbolt cake session storage, either php, cake, database or cache
    SESSION_DEFAULTS: cache
    # -- Configure passbolt cake cache class
    CACHE_DEFAULT_CLASSNAME: Redis
    # -- Configure passbolt cake model cache class
    CACHE_CAKEMODEL_CLASSNAME: Redis
    # -- Configure passbolt cake core cache class
    CACHE_CAKECORE_CLASSNAME: Redis
    # -- Configure passbolt default email service port
    EMAIL_TRANSPORT_DEFAULT_PORT: 587
    # -- Toggle passbolt debug mode
    DEBUG: false
    # -- Configure email used on gpg key. This is used when automatically creating a new gpg server key and when automatically calculating the fingerprint.
    PASSBOLT_KEY_EMAIL: passbolt@solusar.de
    # -- Toggle passbolt selenium mode
    PASSBOLT_SELENIUM_ACTIVE: false
    # -- Configure passbolt license path
    PASSBOLT_PLUGINS_LICENSE_LICENSE: /etc/passbolt/subscription_key.txt
    # -- Configure passbolt default email from
    EMAIL_DEFAULT_FROM: no-reply@passbolt.realm.local
    # -- Configure passbolt default email from name
    EMAIL_DEFAULT_FROM_NAME: Passbolt
    # -- Configure passbolt default email host
    EMAIL_TRANSPORT_DEFAULT_HOST: 127.0.0.1
    # -- Configure passbolt default email timeout
    EMAIL_TRANSPORT_DEFAULT_TIMEOUT: 30
    # -- Toggle passbolt tls
    EMAIL_TRANSPORT_DEFAULT_TLS: true
    # -- Configure passbolt jwt private key path
    PASSBOLT_JWT_SERVER_KEY: /var/www/passbolt/config/jwt/jwt.key
    # -- Configure passbolt jwt public key path
    PASSBOLT_JWT_SERVER_PEM: /var/www/passbolt/config/jwt/jwt.pem
    # -- Toggle passbolt jwt authentication
    PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: true
    # -- Download Command for kubectl
    KUBECTL_DOWNLOAD_CMD: ""
    # -- Set to false to supress warnings when running passbolt commands as non webserver user, mainly for Openshift
    PASSBOLT_SECURITY_DISPLAY_NON_WEBUSER_WARNING: true
  secret:
    # -- Configure passbolt cake cache password
    CACHE_DEFAULT_PASSWORD: ={K=X=6UcS~s^Pa,a,
    # -- Configure passbolt cake core cache password
    CACHE_CAKECORE_PASSWORD: U!L9Ue%"`_-+{.u"vQ
    # -- Configure passbolt cake model cache password
    CACHE_CAKEMODEL_PASSWORD: V!K'_6}Q\%PSufj$eV
    # -- Configure passbolt default database password
    DATASOURCES_DEFAULT_PASSWORD: DW"C_/9jTTkMjwj<'%
    # -- Configure passbolt default database username
    DATASOURCES_DEFAULT_USERNAME: pbadmin
    # -- Configure passbolt default database
    DATASOURCES_DEFAULT_DATABASE: passboltdb
    # -- Configure passbolt default email service username
    EMAIL_TRANSPORT_DEFAULT_USERNAME: admin@solusar.de
    # -- Configure passbolt default email service password
    EMAIL_TRANSPORT_DEFAULT_PASSWORD: #gentoo#
    # -- Configure passbolt server gpg key fingerprint
    # PASSBOLT_GPG_SERVER_KEY_FINGERPRINT:
    # -- Configure passbolt security salt.
    # SECURITY_SALT:
  # -- Environment variables to add to the passbolt pods
  extraEnv: []
  # -- Environment variables from secrets or configmaps to add to the passbolt pods
  extraEnvFrom:
    []
    # - secretRef:
    #     name: passbolt-secret
  ## Overrides the plain value in the case of not wanting to provide the config from values
  ## Do this ONLY if you know what you are doing
  configMapName: ""
  ## Overrides the secrets value in the case of not wanting to provide them in the values file.
  ## Do this ONLY if you know what you are doing
  secretName: ""
## Passbolt deployment parameters

# -- If autoscaling is disabled this will define the number of pods to run
replicaCount: 2

# Configure autoscaling on passbolt deployment
autoscaling:
  # -- Enable autoscaling on passbolt deployment
  enabled: false
  # -- Configure autoscaling minimum replicas
  minReplicas: 1
  # -- Configure autoscaling maximum replicas
  maxReplicas: 100
  # -- Configure autoscaling target CPU uptilization percentage
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

# -- Enable role based access control
rbacEnabled: true

# -- Configure passbolt container livenessProbe
livenessProbe:
  # @ignore
  httpGet:
    port: https
    scheme: HTTPS
    path: /healthcheck/status.json
    httpHeaders:
      - name: Host
        value: passbolt.realm.local
  initialDelaySeconds: 20
  periodSeconds: 10
# -- Configure passbolt container RadinessProbe
readinessProbe:
  # @ignore
  httpGet:
    port: https
    scheme: HTTPS
    httpHeaders:
      - name: Host
        value: passbolt.realm.local
    path: /healthcheck/status.json
  initialDelaySeconds: 5
  periodSeconds: 10

# Configure network policies to allow ingress access passbolt pods
# networkPolicy defines which labels are allowed to reach to passbolt
# and which namespaces
networkPolicy:
  # -- Enable network policies to allow ingress access passbolt pods
  enabled: false
  # -- Configure network policies label for ingress deployment
  label: app.kubernetes.io/name
  # -- Configure network policies podLabel for podSelector
  podLabel: ingress-nginx
  # -- Configure network policies namespaceLabel for namespaceSelector
  namespaceLabel: ingress-nginx

# -- Configure image pull secrets
imagePullSecrets: []
# -- Value to override the chart name on default
nameOverride: ""
# -- Value to override the whole fullName
fullnameOverride: ""

serviceAccount:
  # -- Specifies whether a service account should be created
  create: true
  # -- Annotations to add to the service account
  annotations: {}

# -- Map of annotation for passbolt server pod
podAnnotations: {}

# -- Security Context configuration for passbolt server pod
podSecurityContext:
  {}
  # fsGroup: 2000

service:
  # -- Configure passbolt service type
  type: LoadBalancer
  # -- Annotations to add to the service
  annotations: {}
  # -- Configure the service ports
  ports:
    # -- Configure the HTTPS port
    https:
      # -- Configure passbolt HTTPS service port
      port: 443
      # -- Configure passbolt HTTPS service targetPort
      targetPort: 443
      # -- Configure passbolt HTTPS service port name
      name: https
    http:
      # -- Configure passbolt HTTP service port
      port: 80
      # -- Configure passbolt HTTP service targetPort
      targetPort: 80
      # -- Configure passbolt HTTP service port name
      name: http
  # -- Preference for routing traffic to endpoints that are in the same zone as the client
  # trafficDistribution: "PreferSameZone"

ingress:
  # -- Enable passbolt ingress
  enabled: false
  # -- Configure passbolt ingress annotations
  annotations: {}
  # -- Configure passbolt ingress class name
  # className: "nginx-example"
  # -- Configure passbolt ingress hosts
  hosts:
    # @ignored
    - host: passbolt.realm.local
      paths:
        - path: /
          port: https
          pathType: ImplementationSpecific
  # -- Configure passbolt ingress tls
  tls:
    # If autogenerate is true, the chart will generate a secret for the given hosts
    # if autogenerate is false, existingSecret should be filled with an existing tls kind secret name
    # @ignored
    - autogenerate: true
      # existingSecret: ""
      hosts:
        - passbolt.realm.local
# -- Configure passbolt deployment nodeSelector
nodeSelector: {}

# -- Configure passbolt deployment tolerations
tolerations: []

# -- Configure passbolt deployment affinity
affinity: {}

# -- Add additional volumes, e.g. for overwriting config files
extraVolumes: []

# -- Add additional volume mounts, e.g. for overwriting config files
extraVolumeMounts: []

# Toggle to true if deploying on Openshift
# Removes security context specifying UID from the email cronjob
# Adds a route to use
Openshift: false