# Azure AKS starter values for a first OpenWork EE self-host install.
#
# Follow docs/azure-aks-helm.md to create the VNet, AKS subnet, delegated
# MySQL subnet, AKS cluster, and Azure Database for MySQL Flexible Server.
# Then copy this file, replace every REPLACE_* value, and install with:
#
#   helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
#     --version REPLACE_OPENWORK_VERSION \
#     --namespace openwork-ee \
#     --create-namespace \
#     -f values.azure.yaml
#
# This example exposes Den Web and Den API through the AKS application routing
# add-on's managed NGINX Ingress controller. Use it for production-like Azure
# tests where browser auth and SSO need stable HTTPS hostnames.

image:
  tag: "REPLACE_OPENWORK_VERSION"
  pullPolicy: IfNotPresent

config:
  tenancy:
    mode: single_org
    singleOrgName: "REPLACE_COMPANY_NAME"
    singleOrgSlug: "REPLACE_COMPANY_SLUG"
    ownerEmails: "REPLACE_ADMIN_EMAIL"
    allowPublicSignup: "false"
    requireEmailVerification: "false"
  auth:
    passwordBreachScreeningEnabled: "false"
  public:
    webOrigin: "https://REPLACE_WEB_HOST"
    # Split-origin compatibility override for this two-host ingress example.
    # Leave blank in single-origin deployments so Den derives it from webOrigin.
    apiOrigin: "https://REPLACE_API_HOST"
    mcpResourceUrl: "https://REPLACE_API_HOST/mcp"
    mcpClaimNamespace: "https://REPLACE_WEB_HOST"
    desktopDenBaseUrl: ""
    corsOrigins: "https://REPLACE_WEB_HOST,https://REPLACE_API_HOST"
    betterAuthTrustedOrigins: "https://REPLACE_WEB_HOST"
    webAppHosts: "REPLACE_WEB_HOST"
    bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
    authCallbackUrl: "https://REPLACE_WEB_HOST"
  provisioner:
    mode: stub

secret:
  create: true
  values:
    # Azure Database for MySQL Flexible Server private-network smoke path.
    # sslaccept=accept preserves TLS without requiring a mounted CA bundle.
    databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_MYSQL_SERVER_NAME.mysql.database.azure.com:3306/openwork_den?sslaccept=accept"
    # Generate with: openssl rand -base64 48
    betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
    # Generate separately with: openssl rand -base64 48
    denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
    # One-time /setup code. Generate a unique value and keep it out of source control.
    initialAdminBootstrapCode: "REPLACE_BOOTSTRAP_CODE"
    # Optional SMTP settings for invitations and other transactional email.
    # SMTP delivery requires both emailFrom and smtpHost.
    emailFrom: "OpenWork <no-reply@example.com>"
    smtpHost: ""
    smtpPort: "587"
    smtpUser: ""
    smtpPass: ""
    smtpSecure: "false"

denApi:
  replicaCount: 1
  service:
    type: ClusterIP
    port: 8788

denWeb:
  replicaCount: 1
  service:
    type: ClusterIP
    port: 3005

inference:
  enabled: false

migrations:
  enabled: true
  hook: true

ingress:
  enabled: true
  className: webapprouting.kubernetes.azure.com
  web:
    host: REPLACE_WEB_HOST
  api:
    enabled: true
    host: REPLACE_API_HOST
  tls:
    - secretName: openwork-ee-tls
      hosts:
        - REPLACE_WEB_HOST
        - REPLACE_API_HOST