lasuite-docs/src/helm/env.d/dev/values.impress.yaml.gotmpl

djangoSecretKey: &djangoSecretKey "lkjsdlfkjsldkfjslkdfjslkdjfslkdjf"
djangoSuperUserEmail: admin@example.com
djangoSuperUserPass: admin
aiApiKey: changeme
aiBaseUrl: changeme
oidc:
    clientId: impress
    clientSecret: ThisIsAnExampleKeyForDevPurposeOnly

image:
  repository: localhost:5001/impress-backend
  pullPolicy: Always
  tag: "latest"

backend:
  replicas: 1
  # scraped by the Prometheus of the cluster, see serviceMonitor below
  metrics:
    enabled: true
  envVars:
    PROMETHEUS_API_KEY:
      secretKeyRef:
        name: docs-metrics
        key: PROMETHEUS_API_KEY
    CONVERSION_UPLOAD_ENABLED: True
    DJANGO_CSRF_TRUSTED_ORIGINS: https://docs.127.0.0.1.nip.io
    DJANGO_CONFIGURATION: Feature
    DJANGO_ALLOWED_HOSTS: docs.127.0.0.1.nip.io
    DJANGO_SERVER_TO_SERVER_API_TOKENS: secret-api-key
    DJANGO_SECRET_KEY: *djangoSecretKey
    DJANGO_SETTINGS_MODULE: impress.settings
    DJANGO_SUPERUSER_PASSWORD: admin
    DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
    DJANGO_EMAIL_HOST: "mailcatcher"
    DJANGO_EMAIL_LOGO_IMG: https://docs.127.0.0.1.nip.io/assets/logo-suite-numerique.png
    DJANGO_EMAIL_PORT: 1025
    DJANGO_EMAIL_URL_APP: https://docs.127.0.0.1.nip.io
    DJANGO_EMAIL_USE_SSL: False
    FRONTEND_SILENT_LOGIN_ENABLED: True
    LOGGING_LEVEL_HANDLERS_CONSOLE: ERROR
    LOGGING_LEVEL_LOGGERS_ROOT: INFO
    LOGGING_LEVEL_LOGGERS_APP: INFO
    OIDC_USERINFO_SHORTNAME_FIELD: "first_name"
    OIDC_USERINFO_FULLNAME_FIELDS: "name"
    OIDC_OP_JWKS_ENDPOINT: https://docs-keycloak.127.0.0.1.nip.io/realms/docs/protocol/openid-connect/certs
    OIDC_OP_AUTHORIZATION_ENDPOINT: https://docs-keycloak.127.0.0.1.nip.io/realms/docs/protocol/openid-connect/auth
    OIDC_OP_TOKEN_ENDPOINT: https://docs-keycloak.127.0.0.1.nip.io/realms/docs/protocol/openid-connect/token
    OIDC_OP_USER_ENDPOINT: https://docs-keycloak.127.0.0.1.nip.io/realms/docs/protocol/openid-connect/userinfo
    OIDC_OP_LOGOUT_ENDPOINT: https://docs-keycloak.127.0.0.1.nip.io/realms/docs/protocol/openid-connect/logout
    OIDC_REDIRECT_ALLOWED_HOSTS: "docs.127.0.0.1.nip.io"
    OIDC_RP_CLIENT_ID: docs
    OIDC_RP_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
    OIDC_RP_SIGN_ALGO: RS256
    OIDC_RP_SCOPES: "openid email profile"
    LOGIN_REDIRECT_URL: https://docs.127.0.0.1.nip.io
    LOGIN_REDIRECT_URL_FAILURE: https://docs.127.0.0.1.nip.io
    LOGOUT_REDIRECT_URL: https://docs.127.0.0.1.nip.io
    DB_HOST: dev-backend-postgres
    DB_NAME:
      secretKeyRef:
        name: dev-backend-postgres
        key: database
    DB_USER:
      secretKeyRef:
        name: dev-backend-postgres
        key: username
    DB_PASSWORD:
      secretKeyRef:
        name: dev-backend-postgres
        key: password
    DB_PORT: 5432
    REDIS_URL: redis://default:pass@valkey-docs:6379/0
    DJANGO_CELERY_BROKER_URL: redis://default:pass@valkey-docs:6379/0
    AWS_S3_ENDPOINT_URL: http://dev-backend-minio.impress.svc.cluster.local:9000
    AWS_S3_ACCESS_KEY_ID: dinum
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_STORAGE_BUCKET_NAME: docs-media-storage
    STORAGES_STATICFILES_BACKEND: servestatic.storage.CompressedManifestStaticFilesStorage
    DOCSPEC_API_URL: http://impress-docs-docspec:4000/conversion
    USER_RECONCILIATION_FORM_URL: https://docs.127.0.0.1.nip.io
    # the collaboration server, reached in-cluster: the backend reads and
    # writes document content there, and fetches its JWKS from the same host
    YHUB_API_BASE_URL: http://impress-docs-yhub:443
    Y_PROVIDER_API_BASE_URL: http://impress-docs-y-provider:443/api/
    Y_PROVIDER_API_KEY: my-secret
    CACHES_KEY_PREFIX: "{{ now | unixEpoch }}"
  django:
    envVars:
      WEB_CONCURRENCY: 1
      DB_PSYCOPG_POOL_MIN_SIZE: 10


  migrate:
    command:
      - "/bin/sh"
      - "-c"
      - |
        attempt=0
        until output=$(python manage.py check --database default 2>&1)
        do
          attempt=$((attempt + 1))
          echo "Database check failed (attempt $attempt), retrying in 2s:"
          echo "$output"
          sleep 2
        done

        echo "Database is ready"

        python manage.py migrate --no-input
    restartPolicy: Never

  command:
    - uvicorn
    - --app-dir=/app
    - --host=0.0.0.0
    - --lifespan=off
    - --reload
    - --reload-dir=/app
    - "impress.asgi:application"

  createsuperuser:
    command:
      - "/bin/sh"
      - "-c"
      - |
        attempt=0
        until output=$(python manage.py check --database default 2>&1)
        do
          attempt=$((attempt + 1))
          echo "Database check failed (attempt $attempt), retrying in 2s:"
          echo "$output"
          sleep 2
        done

        echo "Database is ready"
        python manage.py createsuperuser --email admin@example.com --password admin
    restartPolicy: Never

  # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumeMounts:
    - name: certs
      mountPath: /cert/cacert.pem
      subPath: cacert.pem

  # Extra volumes to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
        - key: cacert.pem
          path: cacert.pem
frontend:
  envVars:
    PORT: 8080
    NEXT_PUBLIC_API_ORIGIN: https://docs.127.0.0.1.nip.io

  replicas: 1
  command:
    - yarn
    - dev

  image:
    repository: localhost:5001/impress-frontend
    pullPolicy: Always
    tag: "latest"

  securityContext:
    runAsNonRoot: false

yProvider:
  replicas: 1

  image:
    repository: localhost:5001/impress-y-provider
    pullPolicy: Always
    tag: "latest"

  envVars:
    COLLABORATION_BACKEND_BASE_URL: https://docs.127.0.0.1.nip.io
    COLLABORATION_LOGGING: true
    COLLABORATION_SERVER_ORIGIN: https://docs.127.0.0.1.nip.io
    NODE_EXTRA_CA_CERTS: /cert/cacert.pem

  # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumeMounts:
    - name: certs
      mountPath: /cert/cacert.pem
      subPath: cacert.pem

  # Extra volumes to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
        - key: cacert.pem
          path: cacert.pem

# The keys the backend and the collaboration server sign the calls they make to
# each other with, generated on the cluster by a job into a secret both mount
# read-only.
jwtKeys:
  enabled: true

yhub:
  replicas: 3

  worker:
    enabled: true
    replicas: 2

  # scraped by the Prometheus of the cluster, server and worker apart, see
  # serviceMonitor below
  metrics:
    enabled: true

  image:
    repository: localhost:5001/impress-yhub
    pullPolicy: Always
    tag: "latest"

  envVars:
    # its own logical database on the dev-backend postgres: the init-db job
    # creates it, the backend never touches it
    POSTGRES: postgres://dinum:pass@dev-backend-postgres:5432/yhub
    # a valkey instance of its own too — the backend cache and celery live on
    # valkey-docs
    REDIS: redis://default:pass@valkey-yhub:6379/0
    REDIS_PREFIX: yhub
    PROMETHEUS_API_KEY:
      secretKeyRef:
        name: docs-metrics
        key: PROMETHEUS_API_KEY
    COLLABORATION_BACKEND_BASE_URL: https://docs.127.0.0.1.nip.io
    COLLABORATION_SERVER_ORIGIN: https://docs.127.0.0.1.nip.io
    NODE_EXTRA_CA_CERTS: /cert/cacert.pem
    # YHUB_JWT_PRIVATE_KEY_FILE comes from the jwtKeys job below
    LOG_LEVEL: debug
    YHUB_S3_PERSISTENCE: true
    YHUB_S3_ENDPOINT_URL: http://dev-backend-minio.impress.svc.cluster.local:9000
    YHUB_S3_ACCESS_KEY_ID: dinum
    YHUB_S3_SECRET_ACCESS_KEY: password
    YHUB_S3_BUCKET_NAME: docs-media-storage

  # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumeMounts:
    - name: certs
      mountPath: /cert/cacert.pem
      subPath: cacert.pem

  # Extra volumes to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
        - key: cacert.pem
          path: cacert.pem

docSpec:
  enabled: true
  replicas: 1

  image:
    repository: ghcr.io/docspec/api
    pullPolicy: IfNotPresent
    tag: "1.21.4"

  probes:
    liveness:
      path: /health
    readiness:
      path: /health

ingress:
  enabled: true
  host: docs.127.0.0.1.nip.io
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 20m

ingressCollaborationWS:
  enabled: true
  host: docs.127.0.0.1.nip.io

ingressCollaborationApi:
  enabled: true
  host: docs.127.0.0.1.nip.io

ingressAdmin:
  enabled: true
  host: docs.127.0.0.1.nip.io

posthog:
  ingress:
    enabled: false

  ingressAssets:
    enabled: false

ingressMedia:
  enabled: true
  host: docs.127.0.0.1.nip.io

  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://docs.127.0.0.1.nip.io/api/v1.0/documents/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
    nginx.ingress.kubernetes.io/upstream-vhost: dev-backend-minio.impress.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /docs-media-storage/$1

serviceMedia:
  host: dev-backend-minio.impress.svc.cluster.local
  port: 9000

# One ServiceMonitor per component whose metrics are enabled above — backend,
# yhub, yhub-worker — for the Prometheus of the prometheus release
# (values.prometheus.yaml.gotmpl), which selects every monitor of the
# namespace. The docs-metrics Secret the scrapes present is created there too.
serviceMonitor:
  enabled: true
  interval: 15s