{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "replicaCount": {
      "type": "integer",
      "minimum": 1,
      "description": "Number of pod replicas. Multi-replica requires sticky sessions."
    },
    "image": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "repository": {
          "type": "string",
          "description": "Container image repository."
        },
        "tag": {
          "type": "string",
          "description": "Image tag. Overridden by CI at package time."
        },
        "digest": {
          "type": "string",
          "pattern": "^$|^sha256:[a-f0-9]{64}$",
          "description": "Image digest (sha256:...). When set, takes precedence over tag."
        },
        "pullPolicy": {
          "type": "string",
          "enum": ["Always", "IfNotPresent", "Never"]
        }
      }
    },
    "nameOverride": { "type": "string" },
    "fullnameOverride": { "type": "string" },
    "config": {
      "type": "object",
      "description": "Non-sensitive environment variables injected via ConfigMap. Keys become env var names.",
      "properties": {
        "PORT": { "type": "string", "pattern": "^[0-9]+$" },
        "HOST": {
          "type": "string",
          "description": "Bind address. The chart sets '0.0.0.0' by default so the Kubernetes Service can route to the pod. Combined with AUTH_MODE=oauth (default) this is auth-gated. Setting AUTH_MODE=pat requires HOST=127.0.0.1 — see chart/templates/auth-validation.yaml."
        },
        "USE_SSE": { "type": "string", "enum": ["true", "false"] },
        "USE_STREAMABLE_HTTP": { "type": "string", "enum": ["true", "false"] },
        "GITLAB_API_URL": { "type": "string", "format": "uri" },
        "GITLAB_READ_ONLY_MODE": { "type": "string", "enum": ["true", "false"] },
        "AUTH_MODE": {
          "type": "string",
          "enum": ["pat", "oauth"],
          "description": "Authentication mode: 'pat' uses a static token, 'oauth' uses per-connection Bearer tokens."
        },
        "CORS_ALLOW_ORIGINS": {
          "type": "string",
          "description": "Comma-separated allowed CORS origins. Empty = '*' in PAT mode."
        },
        "HEALTHZ_MAX_SESSIONS": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "Max sessions before /healthz returns 503."
        }
      },
      "additionalProperties": {
        "type": "string"
      }
    },
    "secret": {
      "type": "object",
      "additionalProperties": false,
      "description": "Sensitive values injected via Secret. Required when AUTH_MODE=pat and no existingSecret.",
      "properties": {
        "GITLAB_PERSONAL_ACCESS_TOKEN": { "type": "string" }
      }
    },
    "existingSecret": {
      "type": "string",
      "description": "Name of an existing Secret to use instead of creating one."
    },
    "service": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "type": {
          "type": "string",
          "enum": ["ClusterIP", "NodePort", "LoadBalancer"]
        },
        "port": {
          "type": "integer",
          "minimum": 1,
          "maximum": 65535
        }
      }
    },
    "resources": {
      "type": "object",
      "description": "Pod resource requests and limits.",
      "properties": {
        "requests": {
          "type": "object",
          "properties": {
            "cpu": { "type": "string" },
            "memory": { "type": "string" }
          }
        },
        "limits": {
          "type": "object",
          "properties": {
            "cpu": { "type": "string" },
            "memory": { "type": "string" }
          }
        }
      }
    },
    "extraEnv": {
      "type": "array",
      "description": "Extra env vars (list of {name, value} or {name, valueFrom}).",
      "items": {
        "type": "object",
        "required": ["name"],
        "properties": {
          "name": { "type": "string" },
          "value": { "type": "string" },
          "valueFrom": { "type": "object" }
        }
      }
    },
    "extraEnvFrom": {
      "type": "array",
      "description": "Extra envFrom (list of secretRef/configMapRef).",
      "items": { "type": "object" }
    },
    "nodeSelector": { "type": "object" },
    "tolerations": {
      "type": "array",
      "items": { "type": "object" }
    },
    "affinity": { "type": "object" },
    "podDisruptionBudget": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "enabled": { "type": "boolean" },
        "minAvailable": { "type": "integer", "minimum": 1 },
        "maxUnavailable": { "type": "integer", "minimum": 1 }
      }
    },
    "podAnnotations": { "type": "object" },
    "podLabels": { "type": "object" },
    "serviceAccount": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "create": { "type": "boolean" },
        "name": { "type": "string" }
      }
    },
    "probes": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "liveness": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": { "type": "boolean" },
            "path": { "type": "string" },
            "initialDelaySeconds": { "type": "integer", "minimum": 0 },
            "periodSeconds": { "type": "integer", "minimum": 1 }
          }
        },
        "readiness": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": { "type": "boolean" },
            "path": { "type": "string" },
            "initialDelaySeconds": { "type": "integer", "minimum": 0 },
            "periodSeconds": { "type": "integer", "minimum": 1 }
          }
        }
      }
    }
  }
}