# Production overrides for {{projectName}}.
# REVIEW EVERY VALUE before applying to prod — defaults are conservative
# but every cluster is different.

api:
  replicaCount: 4   # CDC fan-out + cluster workflows scale horizontally
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits:   { cpu: 1000m, memory: 1Gi }

web:
  replicaCount: 3
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits:   { cpu: 1000m, memory: 1Gi }

# ── Database: MariaDB (the company cluster, externally managed) ──────────
# The MariaDB server MUST run binlog_format=ROW + binlog_row_image=FULL and
# the DB user MUST hold REPLICATION SLAVE, REPLICATION CLIENT — the binlog
# reader tails the log for cross-replica real-time. Per-pod POD_NAME/POD_IP
# (→ unique CDC server_id + routable workflow-runner host) is injected
# automatically by deployment-api.yaml at replicaCount > 1.
db:
  dialect: mariadb
  mariadb:
    urlSecretName: {{projectName}}-mariadb   # Secret, key 'url' = mysql://…
    cdc: "1"

# Embedded Postgres is off under db.dialect=mariadb (kept for the postgres
# path). NEVER run an embedded DB in prod for a real load.
postgres:
  embedded: false

# ── Object storage ──────────────────────────────────────────────────────
storage:
  enabled: true
  provider: s3                                # or 'minio' for in-cluster MinIO
  bucket: {{projectNameSnake}}
  # endpoint: https://s3.eu-central-1.amazonaws.com   # for non-AWS / MinIO
  credentialsSecretName: {{projectName}}-s3   # Secret: accessKeyId + secretAccessKey

# Set via a real secret — see templates/secret.yaml comment.
sessionSecret: ""   # MUST come from a Secret

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: {{projectName}}.example.com
      paths:
        - path: /api
          service: api
        - path: /
          service: web
  tls:
    - secretName: {{projectName}}-prod-tls
      hosts:
        - {{projectName}}.example.com