apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: outline
  namespace: outline
spec:
  interval: 10m
  timeout: 10m
  chart:
    spec:
      chart: outline
      version: "0.1.0"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  dependsOn:
    - name: istiod
      namespace: istio-system
    - name: outline-valkey
      namespace: outline
  values:
    universal-chart:
      global:
        env: infra
      image:
        name:
          infra: cr.yandex/crp3ccidau046kdj8g9q/outlinewiki/outline:1.12.0
      envs:
        - name: NODE_ENV
          value:
            _default: production
        - name: URL
          value:
            _default: https://wiki.sarex.space
        - name: PORT
          value:
            _default: "3000"
        - name: WEB_CONCURRENCY
          value:
            _default: "1"
        # TLS терминируется на istio ingressgateway
        - name: FORCE_HTTPS
          value:
            _default: "false"
        - name: ENABLE_UPDATES
          value:
            _default: "false"
        - name: LOG_LEVEL
          value:
            _default: info
        - name: PGSSLMODE
          value:
            _default: disable
        - name: FILE_STORAGE
          value:
            _default: s3
        - name: AWS_REGION
          value:
            _default: ru-msk
        - name: AWS_S3_UPLOAD_BUCKET_URL
          value:
            _default: https://hb.ru-msk.vkcloud-storage.ru
        - name: AWS_S3_UPLOAD_BUCKET_NAME
          value:
            _default: sarex-wiki
        - name: AWS_S3_FORCE_PATH_STYLE
          value:
            _default: "true"
        - name: AWS_S3_ACL
          value:
            _default: private
        # VK Object Storage документирует presigned PUT; presigned POST не описан
        - name: AWS_S3_UPLOAD_METHOD
          value:
            _default: put
        - name: OIDC_DISPLAY_NAME
          value:
            _default: Sarex IAM
        - name: OIDC_AUTH_URI
          value:
            _default: https://iam.sarex.io/oauth/v2/authorize
        - name: OIDC_TOKEN_URI
          value:
            _default: https://iam.sarex.io/oauth/v2/token
        - name: OIDC_USERINFO_URI
          value:
            _default: https://iam.sarex.io/oidc/v1/userinfo
        - name: OIDC_LOGOUT_URI
          value:
            _default: https://iam.sarex.io/oidc/v1/end_session
        - name: OIDC_USERNAME_CLAIM
          value:
            _default: preferred_username
        - name: OIDC_SCOPES
          value:
            _default: openid profile email offline_access
        # SMTP подключается отдельным шагом: добавить SMTP_HOST, SMTP_PORT,
        # SMTP_FROM_EMAIL сюда и SMTP_USERNAME, SMTP_PASSWORD в secretEnvs.
      secretEnvs:
        - name: SECRET_KEY
          secretName:
            _default: outline
          secretKey: SECRET_KEY
        - name: UTILS_SECRET
          secretName:
            _default: outline
          secretKey: UTILS_SECRET
        - name: DATABASE_URL
          secretName:
            _default: outline-postgresql
          secretKey: url
        - name: REDIS_URL
          secretName:
            _default: outline
          secretKey: REDIS_URL
        - name: AWS_ACCESS_KEY_ID
          secretName:
            _default: outline
          secretKey: AWS_ACCESS_KEY_ID
        - name: AWS_SECRET_ACCESS_KEY
          secretName:
            _default: outline
          secretKey: AWS_SECRET_ACCESS_KEY
        - name: OIDC_CLIENT_ID
          secretName:
            _default: outline
          secretKey: OIDC_CLIENT_ID
        - name: OIDC_CLIENT_SECRET
          secretName:
            _default: outline
          secretKey: OIDC_CLIENT_SECRET