# SPDX-License-Identifier: MIT-0
---
# Required: publish an image built from Wikideck's production Dockerfile.
wikideck_image: ""
wikideck_name: wikideck
wikideck_namespace: wikideck
wikideck_create_namespace: true

# null uses normal kubeconfig discovery, including KUBECONFIG.
wikideck_kubeconfig: null
wikideck_kube_context: null
wikideck_wait: true
wikideck_wait_timeout: 900
# Full native RandomX ledger revalidation happens before HTTP starts.
wikideck_startup_probe_failure_threshold: 180
wikideck_image_pull_policy: IfNotPresent
# Existing registry Secret names in the application namespace.
wikideck_image_pull_secrets: []

# Static peer origins, at most 16. Empty means an isolated validator, not a network.
wikideck_peers: []
# Test/private networks only; permits private addresses AND HTTP in the app.
wikideck_allow_private_peers: false
# Exact browser origin, without a trailing slash. Required when using ingress.
wikideck_public_origin: ""
wikideck_ingress_enabled: false
wikideck_ingress_host: ""
wikideck_ingress_class_name: ""
wikideck_ingress_annotations: {}
# Existing TLS Secret, or one provisioned by cert-manager via annotations.
wikideck_tls_secret_name: "{{ wikideck_name }}-tls"

# Persistence is mandatory; existing claims are never modified by this role.
wikideck_existing_claim: ""
wikideck_storage_size: 1Gi
# null: cluster default; "": no StorageClass; otherwise: named class.
wikideck_storage_class: null
wikideck_storage_access_modes:
  - ReadWriteOnce

wikideck_resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: "1"
    memory: 1Gi
wikideck_node_selector: {}
wikideck_tolerations: []
wikideck_affinity: {}

# Requires a NetworkPolicy-capable CNI. Same-namespace clients only by default.
wikideck_network_policy_enabled: true
# Kubernetes NetworkPolicyPeer objects; controller namespaces must be explicit.
wikideck_network_policy_ingress_from:
  - podSelector: {}
# DNS is allowed to kube-system on UDP/TCP 53. Adapt for NodeLocal/custom DNS.
wikideck_network_policy_dns_to:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: kube-system
# Public peer HTTPS egress, emitted only when wikideck_peers is nonempty.
# Standard NetworkPolicy cannot select FQDNs; narrow these CIDRs when practical.
wikideck_network_policy_https_ports:
  - 443
# Explicit additional NetworkPolicy egress rules for private/custom-port peers.
# Each rule must include nonempty 'to' peers and TCP 'ports'. No rules by default.
wikideck_network_policy_peer_egress: []
wikideck_network_policy_https_to:
  - ipBlock:
      cidr: 0.0.0.0/0
      except:
        - 10.0.0.0/8
        - 100.64.0.0/10
        - 127.0.0.0/8
        - 169.254.0.0/16
        - 172.16.0.0/12
        - 192.168.0.0/16
  - ipBlock:
      cidr: "::/0"
      except:
        - "::1/128"
        - "fc00::/7"
        - "fe80::/10"