---
# Uses the controller's kubeconfig / K8S_AUTH_* authentication; never disables TLS verification.
luanti_wasm_namespace: luanti-wasm
luanti_wasm_name: luanti-wasm
# Build and publish your own images. Upstream does not publish these runtime images.
luanti_wasm_web_image: ""
luanti_wasm_proxy_image: ""
luanti_wasm_image_pull_policy: IfNotPresent
luanti_wasm_image_pull_secrets: []
luanti_wasm_replicas: 1
luanti_wasm_web_resources:
  requests:
    cpu: 100m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 256Mi
luanti_wasm_proxy_resources:
  requests:
    cpu: 100m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 256Mi
luanti_wasm_tmp_size_limit: 64Mi
luanti_wasm_node_selector: {}
luanti_wasm_tolerations: []
luanti_wasm_wait: true
luanti_wasm_wait_timeout: 300

luanti_wasm_ingress_enabled: false
luanti_wasm_hostname: ""
luanti_wasm_ingress_class: ""
luanti_wasm_ingress_annotations:
  nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
  nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
  nginx.ingress.kubernetes.io/ssl-redirect: "true"
luanti_wasm_tls_enabled: true
luanti_wasm_tls_secret_name: "{{ luanti_wasm_name }}-tls"
# Empty means a pre-existing, externally managed TLS Secret.
luanti_wasm_cluster_issuer: ""
luanti_wasm_websocket_timeout_seconds: 3600

# NetworkPolicy is unconditional, with no unsupported-CNI bypass.
# [] omits 'from', allowing traffic from any source, but only to TCP 8080.
luanti_wasm_ingress_peers: []
# REQUIRED: literal, canonical, non-/0 IPv4/IPv6 networks for the built-in game destination.
luanti_wasm_game_cidrs: []
luanti_wasm_game_port: 30000
# Empty disables external HTTPS egress; DNS + game UDP remain the only egress rules.
luanti_wasm_https_cidrs: []
luanti_wasm_http_allowed_hosts:
  - content.luanti.org
  - servers.luanti.org