# SPDX-License-Identifier: MIT-0
---
listmonk_name: listmonk
listmonk_namespace: listmonk
listmonk_create_namespace: true

# null uses normal kubeconfig discovery, including KUBECONFIG.
listmonk_kubeconfig: null
listmonk_kube_context: null
listmonk_wait_timeout: 600

listmonk_image: listmonk/listmonk:v6.2.0
listmonk_postgres_image: postgres:17.11-alpine
listmonk_image_pull_policy: IfNotPresent

listmonk_host: listmonk.eom.dev
listmonk_root_url: "https://{{ listmonk_host }}"
listmonk_ingress_class_name: nginx
listmonk_ingress_annotations:
  cert-manager.io/cluster-issuer: ca-issuer
  nginx.ingress.kubernetes.io/proxy-body-size: 16m
listmonk_tls_secret_name: "{{ listmonk_name }}-tls"

listmonk_storage_class: nfs-client
listmonk_db_storage_size: 2Ti
listmonk_uploads_storage_size: 2Ti

# Required secrets (Vault). The database password is only read on first
# initialisation of the volume; change it in Postgres before changing it here.
listmonk_db_password: ""
# Break-glass password login for the "admin" super admin. Day-to-day login is Dex.
listmonk_admin_user: admin
listmonk_admin_password: ""

# Mail goes out through postfix.eom.dev as an LDAP account in "Postfix Users",
# the same pattern Gitea, Nextcloud and PeerTube use. SPOOF_PROTECTION requires
# the From address to belong to that account.
listmonk_smtp_host: postfix.eom.dev
listmonk_smtp_port: 587
listmonk_smtp_tls_type: STARTTLS
listmonk_smtp_username: news
listmonk_smtp_password: ""
listmonk_smtp_max_conns: 4
listmonk_from_email: "eom.dev <news@eom.dev>"

# Log in with Dex. Users are matched by e-mail and must already exist in
# listmonk, so being an eom.dev member alone grants nothing.
listmonk_oidc_enabled: true
listmonk_oidc_provider_url: https://dex.eom.dev/
listmonk_oidc_provider_name: eom.dev account
listmonk_oidc_client_id: listmonk
listmonk_oidc_client_secret: ""
# Accounts allowed to log in through Dex as Super Admin.
listmonk_oidc_admins:
  - username: eric
    name: Eric Meehan
    email: eric@eom.dev

listmonk_site_name: eom.dev
listmonk_logo_url: https://dex.eom.dev/theme/logo.svg
listmonk_favicon_url: https://www.eom.dev/static/favicon.svg
listmonk_notify_emails:
  - eric@eom.dev

# Lists are created by name if missing and never deleted. Existing lists keep
# any edits made in the UI except for type, optin and description.
listmonk_lists:
  - name: eom.dev
    type: public
    optin: double
    tags: [newsletter]
    description: >-
      One short email per premiere, plus the monthly essay. Nothing else.

# API user for the www membership app (Authorization: token user:token).
# It can read and manage subscribers on listmonk_api_lists only. Empty token:
# no API user. listmonk caches API users at startup; the role restarts it.
listmonk_api_user: membership
listmonk_api_token: ""
listmonk_api_role: Membership sync
listmonk_api_lists:
  - eom.dev

# API user for the scheduled newsletter task: create, edit and schedule
# campaigns to listmonk_newsletter_api_lists; no subscriber data or settings.
# Its token is generated once and kept in Secret <name>-newsletter-api
# (keys: url, username, token) for the task to read with kubectl.
listmonk_newsletter_api_enabled: true
listmonk_newsletter_api_user: newsletter
listmonk_newsletter_api_role: Newsletter automation
listmonk_newsletter_api_lists:
  - eom.dev

# Drop the sample lists, subscribers and campaign created by --install.
listmonk_remove_sample_data: true

# Extra settings rows (key: JSON value) merged over the role's own.
listmonk_settings_extra: {}

listmonk_resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    memory: 512Mi
listmonk_postgres_resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    memory: 1Gi

# Keep off the node that runs the ingress controller, like the other services.
listmonk_affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - topologyKey: kubernetes.io/hostname
        namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: ingress-nginx
        labelSelector:
          matchLabels:
            app.kubernetes.io/component: controller
            app.kubernetes.io/name: ingress-nginx