# SPDX-License-Identifier: MIT-0
---
# Required: publish an image built from Wikideck's production Dockerfile.
wikideck_image: ""
wikideck_name: wikideck
wikideck_namespace: wikideck
wikideck_create_namespace: true

# null uses normal kubeconfig discovery, including KUBECONFIG.
wikideck_kubeconfig: null
wikideck_kube_context: null
wikideck_wait: true
wikideck_wait_timeout: 300
wikideck_image_pull_policy: IfNotPresent
# Existing registry Secret names in the application namespace.
wikideck_image_pull_secrets: []

wikideck_offline: false
# Exact browser origin, without a trailing slash. Required when using ingress.
wikideck_public_origin: ""
wikideck_ingress_enabled: false
wikideck_ingress_host: ""
wikideck_ingress_class_name: ""
wikideck_ingress_annotations: {}
# Existing TLS Secret, or one provisioned by cert-manager via annotations.
wikideck_tls_secret_name: "{{ wikideck_name }}-tls"

# Persistence is mandatory; existing claims are never modified by this role.
wikideck_existing_claim: ""
wikideck_storage_size: 1Gi
# null: cluster default; "": no StorageClass; otherwise: named class.
wikideck_storage_class: null
wikideck_storage_access_modes:
  - ReadWriteOnce

wikideck_resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: "1"
    memory: 512Mi
wikideck_node_selector: {}
wikideck_tolerations: []
wikideck_affinity: {}

# Requires a NetworkPolicy-capable CNI. Same-namespace clients only by default.
wikideck_network_policy_enabled: true
# Kubernetes NetworkPolicyPeer objects; controller namespaces must be explicit.
wikideck_network_policy_ingress_from:
  - podSelector: {}
# DNS is allowed to kube-system on UDP/TCP 53. Adapt for NodeLocal/custom DNS.
wikideck_network_policy_dns_to:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: kube-system
# Live article discovery needs HTTPS. Standard NetworkPolicy cannot select FQDNs.
wikideck_network_policy_https_to:
  - ipBlock:
      cidr: 0.0.0.0/0
      except:
        - 10.0.0.0/8
        - 100.64.0.0/10
        - 127.0.0.0/8
        - 169.254.0.0/16
        - 172.16.0.0/12
        - 192.168.0.0/16
  - ipBlock:
      cidr: "::/0"
      except:
        - "::1/128"
        - "fc00::/7"
        - "fe80::/10"