# Build-only config for the eom.dev Discourse image. No secrets belong here:
# database, Redis and SMTP credentials are supplied at runtime by Kubernetes.
templates:
  - "templates/web.template.yml"
  - "templates/web.ratelimited.template.yml"

params:
  version: v2026.10.0

env:
  LC_ALL: en_US.UTF-8
  LANG: en_US.UTF-8
  LANGUAGE: en_US.UTF-8
  DISCOURSE_HOSTNAME: discourse.eom.dev
  DISABLE_LETSENCRYPT: 1

# Everything else the forum uses (openid-connect, reactions, math, post-voting,
# adplugin, subscriptions, chat) is bundled in core at this version.
hooks:
  after_code:
    - exec:
        cd: $home/plugins
        cmd:
          - git clone https://github.com/discourse/discourse-activity-pub.git
          - git clone https://github.com/discourse/discourse-prometheus.git

run:
  # ingress-nginx terminates TLS, so trust its X-Forwarded-For only from the pod
  # network. Without this every visitor shares the ingress IP and hits rate limits.
  - file:
      path: /etc/nginx/conf.d/outlets/server/real-ip.conf
      chmod: 644
      contents: |
        set_real_ip_from 10.244.0.0/16;
        real_ip_header X-Forwarded-For;
        real_ip_recursive on;