#
# paradigm-site is our node.js frontend application.  At the present time it's
# been forked into multiple packages, but in terms of config they are
# functionally identical so a single set of k8s manifests can handle them.
#
# Notes:
#
#  - All resources are named after the release, not the chart.  This is to
#    enable dpeloyment of multiple instances to the smae namespace, e.g. prod
#    distractify/greenmatters.
#


# A prefix for all the resources we create.  Keeping this independent from
# Release.Name means multiple releases of a chart can be deployed to the same
# cluster but retain simple naming.  You don't need to change this unless you
# want multiple copies to coexist in a single namespace.
name: f12-paradigm-site


frontend:

  # Image we will pull and execute for the site.  If default_tag is null it'll
  # be replaced at site deployment time (in the CircleCI build scripts) with the
  # latest build.  We have to do this because Google's image repo randomly
  # caches tags, so if we used a static tag name we couldn't rely on deploying
  # the latest thing we pointed it to.
  image:
    repository: us.gcr.io/f12-tech/www.greenmatters.com
    default_tag: null
    pullPolicy: Always

  # How many replicas to run.  The node.js app isn't demanding so 2 ought to be
  # enough.
  replicaCount: 2

  # Settings passed to the node.js app as environment variables / secrets
  settings:

    # Our local paradigm-api instance.  In all environments it defaults to
    # http://f12-paradigm-api.
    api: "http://f12-paradigm-api"

  # If this isn't a production site you won't want it getting indexed by
  # Google.  Set this to apply basic auth (f12 / 2017).
  lockdown:
    enabled: true

  # htpasswd used for lockdown and to protect non-cdn version of the site
  htpasswd: "f12:$apr1$L.y3nGu1$./bbN7PxXS7iYPDZagtch1"

  # An ingress is used to expose the application to the world.  Optionally it
  # can also do TLS termination with certs obtained by cert-manager.
  ingress:
    class: nginx-main

    # TLS config.  Can be acme (from letsencrypt), static or none at all.  Cert
    # contains TLS cert plus CA bundle if required.  Both are bas64-encoded.
    tls: {}
      # acme: false
      # static:
      #   key:
      #   cert:
      #   ca_bundle:

    # Other annotations to be set on the ingress.  Presently all domains share a
    # single set; it may be necessary to split them out in future.  See
    # https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/
    # for the full list.
    annotations:
      nginx.ingress.kubernetes.io/limit-whitelist: "127.0.0.0/24,192.168/16,172.16/12,10/8"
      nginx.ingress.kubernetes.io/limit-rps: "25"
      nginx.ingress.kubernetes.io/limit-rpm: "200"
      nginx.ingress.kubernetes.io/limit-connections: "100"

    # Redirect http://foo.com/ to http://www.foo.com/.  The behaviour makes the
    # ingress listen for any hostname you've defined minus the www. part,
    # redirecting hits to it to www.domain.  When using this *do not* configure
    # the non-www hostname below.  To enable, add the hostname you want
    # redirecting e.g. greenmatters.com.
    apex_redirect_hostname: null

  # Hostnames the node.js app / gateway will listen on.  The first site hostname
  # is supplied by k8s as a Host: header in health checks.  site_nocdn is used
  # to serve a copy of the site for testing it without a CDN in the way; it is
  # assumed you'll always want a letsencrypt cert for this one.
  hostnames:
    site:
      - greenmatters.local
    # site_nocdn:
    #   - greenmatters.cdnless.com
    static:
      - static.greenmatters.local
    media:
      - media.greenmatters.local

  # Paradigm sites are just a thin layer over paradigm-api.  Giving them
  # relatively low resource requests means they'll be packed onto machines
  # alongside the larger services.
  resources:
    limits:
      cpu: 250m
      memory: 512Mi
    requests:
      cpu: 250m
      memory: 512Mi

  nodeSelector: {}

  tolerations: []

  affinity: {}

  # A service is used to load balance between the replicas.  It's only accessed
  # internally; you shouldn't need to change these.
  service:
    type: ClusterIP
    port: 80



# Gateway is a copy of Nginx used to do some path routing, header management and
# rewriting before requests reach frontend.  It routes media.* requests to
# Thumbor and static.* requests to an assets path within the frontend.
gateway:

  image:
    repository: nginx
    tag: stable-alpine
    pullPolicy: Always

  # How many replicas to run.  Nginx isn't demanding so we don't need a lot.
  # It's deployed a a StatefulSet so the media cache can be stored on
  # restart-proof PersistentVolumes, meaning we don't get a sudden Thumbor load
  # spike whenever a gateway pod migrates.
  replicaCount: 3

  # Even though we're using the default it is necessary to set this so it can
  # be supplied to Nginx in the `resolver` stanza.  This is the only way to
  # set valid= timeouts for upstream DNS addresses.
  nameserver: 10.96.0.10

  # Gateway proxies media requests through to the thumbor service.  But thumbor
  # doesn't cache resize results so we do it upstream here.  Data is stored on a
  # SSD persistentvolume so is preserved across restarts.
  media:
    cache:
      class: ssd
      volume_size: 5Gi
      proxy_cache_size: 4g

  # Nginx is very efficient and can coexist alongside other services.
  resources:
    limits:
      cpu: 100m
      memory: 100Mi
    requests:
      cpu: 50m
      memory: 50Mi

  # Other services in the cluster.  You shouldn't need to change these from the
  # defaults they get deployed with.
  upstreams:
    thumbor: thumbor

  nodeSelector: {}

  tolerations: []

  affinity: {}

  # A service is used to load balance between the replicas.  It's only accessed
  # internally; you shouldn't need to change these.
  service:
    type: ClusterIP
    port: 8080