# Generic Helm values for one supaspin instance (upstream supabase-kubernetes chart).
# Every dollar-brace placeholder below (for example the ANON_KEY one) is replaced by supaspin
# with a quoted string before Helm sees this file.
# Memory limits, priority class and volume sizes are added by supaspin itself (see
# instance_values() in the supaspin script) so they stay in one place next to the caps.
secret:
  jwt:
    anonKey: ${ANON_KEY}
    serviceKey: ${SERVICE_KEY}
    secret: ${JWT_SECRET}
  db:
    password: ${DB_PASSWORD}
    database: postgres
  analytics:
    publicAccessToken: ${LOGFLARE_PUBLIC}
    privateAccessToken: ${LOGFLARE_PRIVATE}
  dashboard:
    username: ${DASHBOARD_USERNAME}
    password: ${DASHBOARD_PASSWORD}
  s3:
    keyId: ${S3_KEY_ID}
    accessKey: ${S3_ACCESS_KEY}
  realtime:
    secretKeyBase: ${REALTIME_SECRET_KEY_BASE}
    dbEncKey: ${REALTIME_DB_ENC_KEY}
  meta:
    cryptoKey: ${META_CRYPTO_KEY}
  smtp:
    username: ${SMTP_USER}
    password: ${SMTP_PASS}

deployment:
  analytics:
    enabled: true
  vector:
    enabled: true

environment:
  auth:
    - {name: API_EXTERNAL_URL, value: ${PUBLIC_URL}}
    - {name: GOTRUE_API_HOST, value: "0.0.0.0"}
    - {name: GOTRUE_API_PORT, value: "9999"}
    - {name: GOTRUE_SITE_URL, value: ${PUBLIC_URL}}
    - {name: GOTRUE_URI_ALLOW_LIST, value: "*"}
    - {name: GOTRUE_DISABLE_SIGNUP, value: "false"}
    - {name: GOTRUE_JWT_DEFAULT_GROUP_NAME, value: authenticated}
    - {name: GOTRUE_JWT_ADMIN_ROLES, value: service_role}
    - {name: GOTRUE_JWT_AUD, value: authenticated}
    - {name: GOTRUE_JWT_EXP, value: "3600"}
    - {name: GOTRUE_EXTERNAL_EMAIL_ENABLED, value: "true"}
    - {name: GOTRUE_MAILER_AUTOCONFIRM, value: "true"}
    - {name: GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED, value: "false"}
    - {name: GOTRUE_SMTP_ADMIN_EMAIL, value: ${SMTP_ADMIN_EMAIL}}
    - {name: GOTRUE_SMTP_HOST, value: ${SMTP_HOST}}
    - {name: GOTRUE_SMTP_PORT, value: ${SMTP_PORT}}
    - {name: GOTRUE_EXTERNAL_PHONE_ENABLED, value: "false"}
    - {name: GOTRUE_SMS_AUTOCONFIRM, value: "false"}
    - {name: GOTRUE_SMTP_SENDER_NAME, value: ${SMTP_SENDER_NAME}}
    - {name: GOTRUE_MAILER_URLPATHS_INVITE, value: /auth/v1/verify}
    - {name: GOTRUE_MAILER_URLPATHS_CONFIRMATION, value: /auth/v1/verify}
    - {name: GOTRUE_MAILER_URLPATHS_RECOVERY, value: /auth/v1/verify}
    - {name: GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE, value: /auth/v1/verify}
  studio:
    - {name: HOSTNAME, value: "::"}
    - {name: STUDIO_PORT, value: "3000"}
    - {name: DEFAULT_ORGANIZATION_NAME, value: Default Organization}
    - {name: DEFAULT_PROJECT_NAME, value: ${PROJECT_NAME}}
    - {name: SUPABASE_PUBLIC_URL, value: ${PUBLIC_URL}}
    - {name: NEXT_ANALYTICS_BACKEND_PROVIDER, value: postgres}

ingress:
  enabled: true
  className: ${INGRESS_CLASS}
  annotations:
    # The chart default rewrites every path to "/", which breaks all APIs; null removes it.
    nginx.ingress.kubernetes.io/rewrite-target: null
    nginx.ingress.kubernetes.io/proxy-body-size: 50m
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    cert-manager.io/cluster-issuer: ${CLUSTER_ISSUER}
  tls:
    - hosts: [${HOST}]
      secretName: ${TLS_SECRET}
  hosts:
    - host: ${HOST}
      paths:
        - path: /
          pathType: Prefix