
# -----------------------------------------------------------
# Security contexts (dev-only: run as root, no restrictions)
# -----------------------------------------------------------

.podSecurityContext: &podSecurityContext
  runAsUser: 0
  runAsGroup: 0
  fsGroup: 0
  runAsNonRoot: false
  seccompProfile:
    type: RuntimeDefault

.securityContext: &securityContext
  allowPrivilegeEscalation: true
  capabilities:
    drop: []

# -----------------------------------------------------------
# Shared anchors
# -----------------------------------------------------------

_summaryEnvVars: &summaryEnvVars
  APP_NAME: summary-microservice
  APP_API_TOKEN: password
  AWS_STORAGE_BUCKET_NAME: meet-media-storage
  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
  AWS_S3_ACCESS_KEY_ID: meet
  AWS_S3_SECRET_ACCESS_KEY: password
  AWS_S3_SECURE_ACCESS: False
  AUTHORIZED_TENANTS: >
    [
      {
        "id": "dictaphone",
        "api_key": "dictaphone_token",
        "webhook_url": "http://dictaphone-backend.dictaphone.svc.cluster.local/api/v1.0/ai-jobs/webhook/",
        "webhook_api_key": "token_summary",
        "allowed_push_to_docs": false
      },
      {
        "id": "meet",
        "api_key": "password",
        "webhook_url": "https://meet.127.0.0.1.nip.io/api/v1.0/recordings/external-process-hook/",
        "webhook_api_key": "webhook-password",
        "allowed_push_to_docs": false
      }
    ]
  SSL_CERT_FILE: /usr/local/lib/python3.13/site-packages/certifi/cacert.pem
  IS_DOCS_INTEGRATION_ENABLED: false
  WHISPERX_API_KEY:
    secretKeyRef:
      name: secret-dev
      key: WHISPERX_API_KEY
  WHISPERX_BASE_URL:
    secretKeyRef:
      name: secret-dev
      key: WHISPERX_BASE_URL
  WHISPERX_ASR_MODEL: openai/whisper-large-v3
  WHISPERX_DEFAULT_LANGUAGE: fr
  LLM_BASE_URL:
    secretKeyRef:
      name: secret-dev
      key: LLM_BASE_URL
  LLM_API_KEY:
    secretKeyRef:
      name: secret-dev
      key: LLM_API_KEY
  LLM_MODEL: Qwen/Qwen3-Coder-30B-A3B-Instruct
  WEBHOOK_API_TOKEN: password
  WEBHOOK_URL: https://www.mock-impress.com/webhook/
  CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
  CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
  TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
  IS_RESOLVE_SPEAKER_IDENTITIES_ENABLED: true
  RESOLVE_SPEAKER_IDENTITIES_DEFAULT_OVERLAP: 0.5
  RESOLVE_SPEAKER_ENABLE_SPLIT_ON_WORDS: true
  RESOLVE_SPEAKER_MAX_WORD_DURATION: 1
  POSTHOG_API_KEY: your-posthog-key
  POSTHOG_ENABLED: False

_summaryImage: &summaryImage
  repository: localhost:5001/meet-summary
  pullPolicy: Always
  tag: "latest"

# -----------------------------------------------------------
# Shared component definitions
# -----------------------------------------------------------
image:
  repository: localhost:5001/meet-backend
  pullPolicy: Always
  tag: "latest"

backend:
  replicas: 1
  envVars:
    DJANGO_CSRF_TRUSTED_ORIGINS: https://meet.127.0.0.1.nip.io,http://meet.127.0.0.1.nip.io
    DJANGO_CONFIGURATION: Production
    DJANGO_ALLOWED_HOSTS: meet.127.0.0.1.nip.io
    DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
    DJANGO_SETTINGS_MODULE: meet.settings
    DJANGO_SILENCED_SYSTEM_CHECKS: security.W004, security.W008
    DJANGO_SUPERUSER_PASSWORD: admin
    # Email notification
    DJANGO_EMAIL_HOST: "mailcatcher"
    DJANGO_EMAIL_PORT: 1025
    DJANGO_EMAIL_USE_SSL: False
    DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
    DJANGO_EMAIL_SUPPORT_EMAIL: "test@yopmail.com"
    DJANGO_EMAIL_LOGO_IMG: https://meet.127.0.0.1.nip.io/assets/logo-suite-numerique.png
    DJANGO_EMAIL_DOMAIN: meet.127.0.0.1.nip.io
    DJANGO_EMAIL_APP_BASE_URL: https://meet.127.0.0.1.nip.io
    # OIDC & Auth
    OIDC_OP_JWKS_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/certs
    OIDC_OP_AUTHORIZATION_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/auth
    OIDC_OP_TOKEN_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/token
    OIDC_OP_USER_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/userinfo
    OIDC_OP_LOGOUT_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/logout
    OIDC_RP_CLIENT_ID: meet
    OIDC_RP_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
    OIDC_RP_SIGN_ALGO: RS256
    OIDC_RP_SCOPES: "openid email"
    OIDC_REDIRECT_ALLOWED_HOSTS: https://meet.127.0.0.1.nip.io
    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
    LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
    LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
    LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
    # Databases
    DB_HOST: postgres
    DB_NAME: meet
    DB_USER: dinum
    DB_PASSWORD: pass
    DB_PORT: 5432
    REDIS_URL: redis://default:pass@redis-master:6379/1
    # Static files
    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
    # Permissions
    ALLOW_UNREGISTERED_ROOMS: False
    # Certs for dev purpose only
    SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
    # Livekit
    {{- with .Values.livekit.keys }}
    {{- range $key, $value := . }}
    LIVEKIT_API_SECRET: {{ $value }}
    LIVEKIT_API_KEY: {{ $key }}
    {{- end }}
    {{- end }}
    LIVEKIT_API_URL: https://livekit.127.0.0.1.nip.io/
    LIVEKIT_WEBHOOK_EVENTS_FILTER_REGEX: "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
    # Frontend
    LIVEKIT_FORCE_WSS_PROTOCOL: True
    LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND: True
    FRONTEND_IDLE_DISCONNECT_WARNING_DELAY: 9000
    FRONTEND_SILENCE_LIVEKIT_DEBUG: False
    FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041', 'help_article_transcript': 'https://lasuite.crisp.help/fr/article/visio-transcript-1sjq43x', 'help_article_recording': 'https://lasuite.crisp.help/fr/article/visio-enregistrement-wgc8o0', 'help_article_more_tools': 'https://lasuite.crisp.help/fr/article/visio-tools-bvxj23'}"
    FRONTEND_FEEDBACK: "{'url': 'https://grist.numerique.gouv.fr/o/docs/cbMv4G7pLY3Z/USER-RESEARCH-or-LA-SUITE/f/26'}"
    FRONTEND_DOCUMENTATION_URL: "https://docs.numerique.gouv.fr/docs/7c5bd65d-3c21-486f-bce1-26e0a921d642/"
    FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
    FRONTEND_IDLE_DISCONNECT_WARNING_DELAY: 9000
    FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
    FRONTEND_IS_SILENT_LOGIN_ENABLED: False
    # S3 Storage
    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
    AWS_S3_ACCESS_KEY_ID: meet
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    # Telephony
    ROOM_TELEPHONY_ENABLED: True
    ROOM_TELEPHONY_DEFAULT_COUNTRY: 'FR'
    ROOM_TELEPHONY_PHONE_NUMBER: '+33901020304'
    # Metadata Agent
    METADATA_COLLECTOR_ENABLED: True
    # External API
    EXTERNAL_API_ENABLED: True
    # Service Account
    APPLICATION_JWT_AUDIENCE: https://meet.127.0.0.1.nip.io/external-api/v1.0/
    APPLICATION_JWT_SECRET_KEY: devKeyApplication
    APPLICATION_BASE_URL: https://meet.127.0.0.1.nip.io
    # Custom Background
    AWS_S3_REGION_NAME: local
    AWS_S3_SIGNATURE_VERSION: s3v4
    AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
    MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
    FILE_UPLOAD_ENABLED: True
    CELERY_ENABLED: True
    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
    # Recording & Transcription
    RECORDING_ENABLE: True
    RECORDING_STORAGE_EVENT_ENABLE: True
    RECORDING_STORAGE_EVENT_TOKEN: password
    SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v2/async-jobs/transcribe/
    SUMMARY_SERVICE_API_TOKEN: password
    SUMMARY_SERVICE_WEBHOOK_API_TOKEN: webhook-password
    RECORDING_DOWNLOAD_BASE_URL: https://meet.127.0.0.1.nip.io/recording
    OIDC_USERINFO_FULLNAME_FIELDS: first_name, last_name
    OIDC_USERINFO_SHORTNAME_FIELD: first_name

  migrate:
    command:
      - "/bin/sh"
      - "-c"
      - |
        python manage.py migrate --no-input
    restartPolicy: Never

  command:
    - "gunicorn"
    - "-c"
    - "/usr/local/etc/gunicorn/meet.py"
    - "meet.wsgi:application"
    - "--reload"

  createsuperuser:
    command:
      - "/bin/sh"
      - "-c"
      - |
        python manage.py createsuperuser --email admin@example.com --password admin
    restartPolicy: Never

  extraVolumeMounts:
    - name: certs
      mountPath: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
      subPath: cacert.pem

  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
          - key: cacert.pem
            path: cacert.pem

  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

frontend:
  replicas: 1
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

ingress:
  enabled: true
  host: meet.127.0.0.1.nip.io

ingressAdmin:
  enabled: true
  host: meet.127.0.0.1.nip.io

ingressWebhook:
  enabled: true
  host: meet.127.0.0.1.nip.io

posthog:
  ingress:
    enabled: false
  ingressAssets:
    enabled: false

# ---- Extra ingress/service for recording file downloads -----------

ingressMedia:
  enabled: true
  host: meet.127.0.0.1.nip.io
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1

serviceMedia:
  host: minio.meet.svc.cluster.local
  port: 9000

# ---- Extra ingress/service for background file uploads ------------

ingressMediaFiles:
  enabled: true
  host: meet.127.0.0.1.nip.io

  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1

serviceMediaFiles:
  host: minio.meet.svc.cluster.local
  port: 9000

# ---- STT Orchestration Microservice Components --------------------

summary:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

celeryTranscribe:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext
  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "transcribe-queue-v2"

celerySummarize:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext
  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "summarize-queue-v2"

celerySummaryBackend:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "call-webhook-queue-v2"

# ---- Livekit agents components ------------------------------------

agentMetadata:
  replicas: 1
  envVars:
    LIVEKIT_URL: https://livekit.127.0.0.1.nip.io/
    {{- with .Values.livekit.keys }}
    {{- range $key, $value := . }}
    LIVEKIT_API_SECRET: {{ $value }}
    LIVEKIT_API_KEY: {{ $key }}
    {{- end }}
    {{- end }}
    ENABLE_SILERO_VAD: "false"
    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
    AWS_S3_ACCESS_KEY_ID: meet
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_S3_SECURE_ACCESS: False
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    AWS_S3_OUTPUT_FOLDER: metadata

  image:
    repository: localhost:5001/meet-agents
    pullPolicy: Always
    tag: "latest"

  command:
    - "python"
    - "metadata_collector.py"
    - "start"

  # Extra volume mounts to manage our local custom CA and avoid to disable ssl
  extraVolumeMounts:
    - name: certs
      mountPath: /usr/lib/ssl/cert.pem
      subPath: cert.pem

  # Extra volumes to manage our local custom CA and avoid to disable ssl
  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
        - key: cacert.pem
          path: cert.pem
