# Plane CE hardened values — DRAFT (2026-09-03), NOT applied.
# Target file on host: /home/windy/plane-k3s/values.yaml (synapse.chans.xyz)
# Reference release: plane-app, chart plane-ce-1.8.0 (values.yaml L1-362 + templates verified 2026-09-03).
# No secrets in this file. Secret *values* live only in k8s Secrets (see secrets.yaml.example).
#
# Two phases:
#   Phase A: externalize secrets (reference names below) with CURRENT values copied -> zero change.
#   Phase B: rotate credentials one by one (see README.md). SECRET_KEY rotation is cheap only while
#            SMTP/OAuth are unconfigured (no encrypted config rows yet).

planeVersion: v1.4.1

ingress:
  enabled: true
  appHost: plane.chans.xyz
  ingressClass: traefik
  traefik:
    # 20 MiB (chart default). Keep aligned with env.doc_upload_size_limit below.
    maxRequestBodyBytes: 20971520

ssl:
  createIssuer: true
  issuer: http          # HTTP-01; ssl_token_existingSecret not needed
  email: admin@chans.xyz
  generateCerts: true

postgres:
  storageClass: local-path
  volumeSize: 5Gi
  # NOTE: chart 1.8.0 exposes NO resources knob for the bundled datastores
  # (stateful templates render no resources block). Add limits via
  # --post-renderer/kustomize or `kubectl -n plane patch sts ...` re-applied on
  # every upgrade (P2 task; see README.md).

redis:
  storageClass: local-path
  # image: valkey/valkey:7.2.11-alpine   # already pinned by chart default; uncomment to make explicit

minio:
  # P2: pin. Digest of the currently running :latest (2026-09-03, pod plane-app-minio-wl-0).
  image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
  # image_mc: minio/mc@sha256:...   # optional: pin one-shot bucket-init client the same way
  storageClass: local-path
  volumeSize: 5Gi

rabbitmq:
  storageClass: local-path

env:
  # Fail the render instead of ever falling back to the chart's PUBLIC constants
  # (values.yaml L340-341 in chart 1.8.0). Requires external_secrets below.
  requireExplicitSecrets: true

  # SECRET_KEY / LIVE_SERVER_SECRET_KEY are deliberately OMITTED here.
  # They live in k8s Secret `plane-app-keys` (referenced below). With
  # requireExplicitSecrets=true and app_keys_existingSecret set, the chart renders
  # neither key itself and app+live workloads both envFrom `plane-app-keys` LAST
  # (later envFrom wins), which keeps the shared signing key consistent.

  pgdb_name: plane
  docstore_bucket: uploads
  # Align app-side upload cap with the Traefik body limit (was 5242880/5MiB).
  # Keep both at 20MiB, or lower both together.
  doc_upload_size_limit: "20971520"

external_secrets:
  # Shared signing keys (used by app + live). REQUIRED keys: SECRET_KEY, LIVE_SERVER_SECRET_KEY.
  app_keys_existingSecret: plane-app-keys
  # REQUIRED keys: REDIS_URL, DATABASE_URL, AMQP_URL (chart-derived URLs; update on DB/queue rotation).
  app_env_existingSecret: plane-app-env
  # REQUIRED keys: REDIS_URL.
  live_env_existingSecret: plane-live-env
  # REQUIRED keys: POSTGRES_PASSWORD, POSTGRES_DB, POSTGRES_USER.
  pgdb_existingSecret: plane-pgdb-credentials
  # REQUIRED keys: RABBITMQ_DEFAULT_USER, RABBITMQ_DEFAULT_PASS.
  rabbitmq_existingSecret: plane-rabbitmq-credentials
  # REQUIRED keys: FILE_SIZE_LIMIT, AWS_S3_BUCKET_NAME, USE_MINIO, MINIO_ROOT_USER,
  # MINIO_ROOT_PASSWORD, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_S3_ENDPOINT_URL.
  doc_store_existingSecret: plane-minio-credentials
  # ssl_token_existingSecret: ''   # DNS-01 only (cloudflare/digitalocean); unused with HTTP-01

# Optional, P2: HTTP -> HTTPS 301. The chart's own IngressRoute binds only
# 'websecure' (http:// currently 404s). extraObjects is rendered verbatim (toYaml).
# Uncomment and `helm upgrade` once reviewed:
# extraObjects:
#   - apiVersion: traefik.io/v1alpha1
#     kind: Middleware
#     metadata:
#       name: plane-https-redirect
#       namespace: plane
#     spec:
#       redirectScheme:
#         scheme: https
#         permanent: true
#   - apiVersion: traefik.io/v1alpha1
#     kind: IngressRoute
#     metadata:
#       name: plane-http-to-https
#       namespace: plane
#     spec:
#       entryPoints: [web]
#       routes:
#         - match: Host(`plane.chans.xyz`)
#           kind: Rule
#           middlewares:
#             - name: plane-https-redirect
#           services:
#             - name: plane-app-web
#               port: 3000