# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Default values for OpenShell

replicaCount: 1

image:
  repository: ghcr.io/nvidia/openshell/gateway
  pullPolicy: Always
  tag: "latest"

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  create: true
  annotations: {}
  name: ""

podAnnotations: {}
podLabels: {}

podSecurityContext:
  fsGroup: 1000

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

service:
  type: NodePort
  port: 8080
  nodePort: 30051

# Pod restart behavior and health probe tuning.
podLifecycle:
  terminationGracePeriodSeconds: 5

probes:
  startup:
    periodSeconds: 2
    timeoutSeconds: 1
    failureThreshold: 30
  liveness:
    initialDelaySeconds: 2
    periodSeconds: 5
    timeoutSeconds: 1
    failureThreshold: 3
  readiness:
    initialDelaySeconds: 1
    periodSeconds: 2
    timeoutSeconds: 1
    failureThreshold: 3

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

# Server configuration
server:
  logLevel: info
  sandboxNamespace: openshell
  dbUrl: "sqlite:/var/openshell/openshell.db"
  sandboxImage: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
  # Kubernetes imagePullPolicy for sandbox pods.  Empty = Kubernetes default
  # (Always for :latest, IfNotPresent otherwise).  Set to "Always" for dev
  # clusters so new images are picked up without manual eviction.
  sandboxImagePullPolicy: ""
  # gRPC endpoint for sandboxes to callback to OpenShell (must be reachable from pods)
  grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080"
  # Public host/port returned to CLI clients for SSH proxy CONNECT requests.
  # For local clusters the default 127.0.0.1:8080 is correct; for remote
  # clusters these should be set to the externally reachable host and port.
  sshGatewayHost: ""
  sshGatewayPort: 0
  # TLS configuration for the server. The server always terminates mTLS
  # directly and requires client certificates.
  # Name of the Kubernetes Secret holding the NSSH1 HMAC handshake key.
  # The secret must contain a `secret` key with the hex-encoded HMAC key.
  # For cluster deployments this is auto-created by the bootstrap process.
  sshHandshakeSecretName: "openshell-ssh-handshake"
  # Host gateway IP for sandbox pod hostAliases. When set, sandbox pods get
  # hostAliases entries mapping host.docker.internal and host.openshell.internal
  # to this IP, allowing them to reach services running on the Docker host.
  # Auto-detected by the cluster entrypoint script.
  hostGatewayIP: ""
  # Disable gateway authentication (mTLS client certificate requirement).
  # Set to true when the gateway sits behind a reverse proxy (e.g.
  # Cloudflare Tunnel) that terminates TLS.
  disableGatewayAuth: false
  # Disable TLS entirely — the server listens on plaintext HTTP.
  # Set to true when a reverse proxy / tunnel terminates TLS at the edge.
  disableTls: false
  tls:
    # K8s secret (type kubernetes.io/tls) with tls.crt and tls.key for the server
    certSecretName: openshell-server-tls
    # K8s secret with ca.crt for client certificate verification
    clientCaSecretName: openshell-server-client-ca
    # K8s secret mounted into sandbox pods for mTLS to the server
    clientTlsSecretName: openshell-client-tls

# NetworkPolicy restricting SSH ingress on sandbox pods to the gateway only.
networkPolicy:
  enabled: true