# Meerkat, Enterprise edition, one gateway, with the developer tunnel open.
#
#   kubectl create secret docker-registry ghcr \
#     --docker-server=ghcr.io --docker-username=USER --docker-password=TOKEN
#   helm repo add meerkat https://meerkat.softwarity.dev/deploy
#   helm install meerkat meerkat/meerkat -f https://meerkat.softwarity.dev/deploy/values-ee-one-node.yaml \
#     --set admin.password='choose-one'
#
# Same shape as the community one - a single pod on its volume - with the
# Enterprise image: several organisations, the directories, and the tunnel
# that plugs a developer's machine into this cluster.
image:
  repository: ghcr.io/softwarity/meerkat
  tag: ""
  # The Enterprise image is on a private registry: name the pull secret you
  # created for it.
  pullSecrets:
    - ghcr

replicaCount: 1

admin:
  password: ""

# The vault's master key. Optional on a single gateway - left alone it keeps
# one in its data directory, which is enough while there is one pod and one
# volume. Set it the day you go clustered, and keep it: losing it loses every
# secret in the vault.
vault:
  key: ""

persistence:
  enabled: true
  size: 2Gi
  storageClass: ""

# The developer tunnel. It opens only where developer mode is on AND the
# gateway can reach the orchestrator - the chart's RBAC is that grant. Each
# developer deposits their own public key in their profile, so a connection
# says who rather than proving somebody has the client.
plug:
  enabled: true
  port: 22222
  service:
    # ClusterIP keeps it inside; NodePort or LoadBalancer is how developers
    # reach it from their machines. Your network, your call.
    type: ClusterIP
    nodePort: ""

# The authorities the cluster publishes, found by Domains & TLS, Trusted
# authorities, From the cluster: what signs the services a route in HTTPS
# calls. cert-manager: list the issuers, and learn one's certificate from a
# throwaway Certificate (<release>-meerkat-trust-probe, deleted at once) -
# never from the issuer's Secret, which holds its key. trust-manager: list the
# Bundles and read their ConfigMap in this namespace. On by default; false
# leaves the certificate to import by hand.
trustDiscovery:
  certManager: true
  trustManager: true