p2p

defaults/main.yml

@@ -10,12 +10,17 @@ wikideck_create_namespace: true
 wikideck_kubeconfig: null
 wikideck_kube_context: null
 wikideck_wait: true
-wikideck_wait_timeout: 300
+wikideck_wait_timeout: 900
+# Full native RandomX ledger revalidation happens before HTTP starts.
+wikideck_startup_probe_failure_threshold: 180
 wikideck_image_pull_policy: IfNotPresent
 # Existing registry Secret names in the application namespace.
 wikideck_image_pull_secrets: []
 
-wikideck_offline: false
+# Static peer origins, at most 16. Empty means an isolated validator, not a network.
+wikideck_peers: []
+# Test/private networks only; permits private addresses AND HTTP in the app.
+wikideck_allow_private_peers: false
 # Exact browser origin, without a trailing slash. Required when using ingress.
 wikideck_public_origin: ""
 wikideck_ingress_enabled: false
@@ -35,11 +40,11 @@ wikideck_storage_access_modes:
 
 wikideck_resources:
   requests:
-    cpu: 100m
-    memory: 128Mi
+    cpu: 250m
+    memory: 512Mi
   limits:
     cpu: "1"
-    memory: 512Mi
+    memory: 1Gi
 wikideck_node_selector: {}
 wikideck_tolerations: []
 wikideck_affinity: {}
@@ -54,7 +59,13 @@ wikideck_network_policy_dns_to:
   - namespaceSelector:
       matchLabels:
         kubernetes.io/metadata.name: kube-system
-# Live article discovery needs HTTPS. Standard NetworkPolicy cannot select FQDNs.
+# Public peer HTTPS egress, emitted only when wikideck_peers is nonempty.
+# Standard NetworkPolicy cannot select FQDNs; narrow these CIDRs when practical.
+wikideck_network_policy_https_ports:
+  - 443
+# Explicit additional NetworkPolicy egress rules for private/custom-port peers.
+# Each rule must include nonempty 'to' peers and TCP 'ports'. No rules by default.
+wikideck_network_policy_peer_egress: []
 wikideck_network_policy_https_to:
   - ipBlock:
       cidr: 0.0.0.0/0