92 lines
3.2 KiB
YAML
92 lines
3.2 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
# Required: publish an image built from Wikideck's production Dockerfile.
|
|
wikideck_image: ""
|
|
wikideck_name: wikideck
|
|
wikideck_namespace: wikideck
|
|
wikideck_create_namespace: true
|
|
|
|
# null uses normal kubeconfig discovery, including KUBECONFIG.
|
|
wikideck_kubeconfig: null
|
|
wikideck_kube_context: null
|
|
wikideck_wait: true
|
|
wikideck_wait_timeout: 900
|
|
# Full native RandomX ledger revalidation happens before HTTP starts.
|
|
wikideck_startup_probe_failure_threshold: 180
|
|
wikideck_image_pull_policy: IfNotPresent
|
|
# Existing registry Secret names in the application namespace.
|
|
wikideck_image_pull_secrets: []
|
|
|
|
# Static peer origins, at most 16. Empty means an isolated validator, not a network.
|
|
wikideck_peers: []
|
|
# Test/private networks only; permits private addresses AND HTTP in the app.
|
|
wikideck_allow_private_peers: false
|
|
# Explicit mainnet candidate startup gates. Never set these before launch approval.
|
|
wikideck_mainnet_launch: ""
|
|
wikideck_mainnet_risk_ack: ""
|
|
# Exact browser origin, without a trailing slash. Required when using ingress.
|
|
wikideck_public_origin: ""
|
|
wikideck_ingress_enabled: false
|
|
wikideck_ingress_host: ""
|
|
wikideck_ingress_class_name: ""
|
|
wikideck_ingress_annotations: {}
|
|
# Existing TLS Secret, or one provisioned by cert-manager via annotations.
|
|
wikideck_tls_secret_name: "{{ wikideck_name }}-tls"
|
|
|
|
# Persistence is mandatory; existing claims are never modified by this role.
|
|
wikideck_existing_claim: ""
|
|
wikideck_storage_size: 1Gi
|
|
# null: cluster default; "": no StorageClass; otherwise: named class.
|
|
wikideck_storage_class: null
|
|
wikideck_storage_access_modes:
|
|
- ReadWriteOnce
|
|
|
|
wikideck_resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
wikideck_node_selector: {}
|
|
wikideck_tolerations: []
|
|
wikideck_affinity: {}
|
|
# Trust only literal proxy source IPs/CIDRs whose edge overwrites forwarded headers.
|
|
wikideck_trusted_proxies: []
|
|
# Optional private operations listener; application binds it to container loopback.
|
|
wikideck_ops_port: ""
|
|
|
|
# Requires a NetworkPolicy-capable CNI. Same-namespace clients only by default.
|
|
wikideck_network_policy_enabled: true
|
|
# Kubernetes NetworkPolicyPeer objects; controller namespaces must be explicit.
|
|
wikideck_network_policy_ingress_from:
|
|
- podSelector: {}
|
|
# DNS is allowed to kube-system on UDP/TCP 53. Adapt for NodeLocal/custom DNS.
|
|
wikideck_network_policy_dns_to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
# Public peer HTTPS egress, emitted only when wikideck_peers is nonempty.
|
|
# Standard NetworkPolicy cannot select FQDNs; narrow these CIDRs when practical.
|
|
wikideck_network_policy_https_ports:
|
|
- 443
|
|
# Explicit additional NetworkPolicy egress rules for private/custom-port peers.
|
|
# Each rule must include nonempty 'to' peers and TCP 'ports'. No rules by default.
|
|
wikideck_network_policy_peer_egress: []
|
|
wikideck_network_policy_https_to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 127.0.0.0/8
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- ipBlock:
|
|
cidr: "::/0"
|
|
except:
|
|
- "::1/128"
|
|
- "fc00::/7"
|
|
- "fe80::/10"
|