image:
  repository: ghcr.io/CHANGE-ME/photos
  tag: latest
  pullPolicy: IfNotPresent

api:
  replicas: 1
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      memory: 1Gi

worker:
  replicas: 1
  concurrency: 2
  resources:
    requests:
      cpu: 200m
      memory: 256Mi
    limits:
      memory: 2Gi

# External base URL of the app; the OIDC redirect URI is <publicUrl>/api/auth/callback
publicUrl: https://photos.example.com

config:
  s3:
    # Leave endpoint empty for AWS S3; set for MinIO/Ceph/etc.
    endpoint: ""
    region: us-east-1
    bucket: photos
    forcePathStyle: false
  oidcIssuer: https://auth.example.com
  # Comma-separated photographer emails allowed to sign in
  allowedEmails: you@example.com
  logLevel: info,sqlx=warn

# Sensitive settings. Either reference an existing Secret containing the keys
# DATABASE_URL, S3_ACCESS_KEY, S3_SECRET_KEY, OIDC_CLIENT_ID,
# OIDC_CLIENT_SECRET, SESSION_SECRET — or inline the values and the chart
# creates the Secret for you.
secrets:
  existingSecret: ""
  databaseUrl: ""
  s3AccessKey: ""
  s3SecretKey: ""
  oidcClientId: ""
  oidcClientSecret: ""
  sessionSecret: ""

service:
  port: 80

ingress:
  enabled: true
  className: traefik
  host: photos.example.com
  # Traefik needs nothing extra: no default body-size limit, streams uploads.
  # For ingress-nginx set className: nginx and uncomment (multi-GB raw
  # uploads hit nginx's 1MiB default limit otherwise):
  #   nginx.ingress.kubernetes.io/proxy-body-size: "0"
  #   nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
  annotations: {}
  tls:
    enabled: true
    secretName: photos-tls