nameOverride: ""
fullnameOverride: ""

image:
  tag: latest
  pullPolicy: IfNotPresent

imagePullSecrets: []

config:
  databaseMode: mysql
  openworkDevMode: "0"
  # Passed to the den-api Node.js process as NODE_OPTIONS at container startup.
  denApiNodeOptions: ""
  tenancy:
    mode: single_org
    singleOrgName: OpenWork
    singleOrgSlug: default
    ownerEmails: ""
    allowPublicSignup: "false"
    requireEmailVerification: "false"
  auth:
    passwordBreachScreeningEnabled: "false"
  githubConnector:
    appId: ""
    clientId: ""
  public:
    # Single public Den web origin. The chart passes this as DEN_BASE_URL; den-api
    # derives Better Auth, CORS/trusted origins, web-app hosts, API defaults, and
    # MCP resource defaults from it unless the compatibility overrides below are set.
    webOrigin: https://openwork.example.com
    # Compatibility overrides for split-origin or migration deployments.
    apiOrigin: ""
    mcpResourceUrl: ""
    mcpAdditionalResources: ""
    # Leave blank to keep External MCP URL SSRF protection enabled.
    # Set "1" only for trusted private-network MCP servers.
    allowPrivateMcpUrls: ""
    mcpClaimNamespace: ""
    desktopDenBaseUrl: ""
    corsOrigins: ""
    betterAuthCookieDomain: ""
    betterAuthTrustedOrigins: ""
    webAppHosts: ""
    bootstrapAdminEmails: ""
    installLinksGatingEnabled: "false"
    # Self-hosted Automations are opt-in. Hosted OpenWork Cloud enables them.
    automationsEnabled: "false"
    # Self-hosted Dashboards are opt-in. Hosted environments use the same Den flag.
    dashboardsEnabled: "false"
    # OpenWork Web is hosted-only by default. OpenWork Cloud enables it explicitly.
    openworkWebEnabled: "false"
    # Preserve the Den runtime for published legacy Desktops during upgrades.
    # Set false only after every Desktop is v0.18.35+ to hard-disable Automations.
    automationsRuntimeEnabled: "true"
    # Enable only after compatible Desktop MCP Apps hosts are deployed.
    generatedArtifactViewsEnabled: "false"
    connectLinkMode: exchange
    connectLinkKeyId: ""
    openworkAppConnectUrl: ""
    openworkWebUrl: ""
    installerReleaseTag: ""
    installerReleaseRepo: ""
    authCallbackUrl: https://openwork.example.com
  internal:
    apiBaseUrl: ""
    authFallbackBaseUrl: ""
    inferenceProxyBaseUrl: ""
  provisioner:
    mode: stub
    reconcileIntervalMs: "60000"
    reconcileStaleMs: "1200000"
    reconcileBatchSize: "10"
    workerUrlTemplate: ""
  daytona:
    apiUrl: ""
    target: ""
    snapshot: ""
    sandboxImage: ""
    sandboxCpu: ""
    sandboxMemory: ""
    sandboxDisk: ""
    sandboxPublic: ""
    sandboxAutoStopInterval: ""
    sandboxAutoArchiveInterval: ""
    sandboxAutoDeleteInterval: ""
    signedPreviewExpiresSeconds: "86400"
    sandboxNamePrefix: ""
    sharedVolumeName: ""
    volumeNamePrefix: ""
    workspaceMountPath: ""
    dataMountPath: ""
    runtimeWorkspacePath: ""
    runtimeDataPath: ""
    sidecarDir: ""
    openworkPort: ""
    opencodePort: ""
    createTimeoutSeconds: ""
    deleteTimeoutSeconds: ""
    healthcheckTimeoutMs: ""
  polar:
    featureGateEnabled: "false"
    apiBase: ""
    productId: ""
    benefitId: ""
    successUrl: ""
    returnUrl: ""
  inference:
    openRouterWorkspaceId: ""
    stripeInferencePriceId: ""
    openRouterUpstreamUrl: ""
    creditsPerDollar: ""
  web:
    posthogKey: ""
    posthogHost: ""

observability:
  backend: none
  serviceNames:
    denApi: den-api
    denWeb: den-web
  otel:
    endpoint: ""
    tracesEndpoint: ""
    metricsEndpoint: ""
    logsEndpoint: ""
    protocol: http/protobuf
    exporters:
      traces: otlp
      metrics: otlp
      logs: otlp
    tracesSampler: parentbased_always_on
    tracesSamplerArg: ""
    headers:
      existingSecret: ""
      key: OTEL_EXPORTER_OTLP_HEADERS
  sentry:
    dsn: ""
    dsnSecret:
      existingSecret: ""
      key: SENTRY_DSN
    tracesSampleRate: "0.01"
    environment: ""
    release: ""
    dist: ""

customCa:
  enabled: false
  existingSecret: ""
  existingConfigMap: ""
  key: ca.crt

redis:
  # Prefer rediss:// DATABASE_REDIS_URL values. Set this to true only for
  # trusted private, non-public Redis endpoints that do not support TLS, such as
  # some managed internal Redis URLs exposed by hosting platforms.
  allowInsecureInternal: false

secret:
  create: true
  existingSecret: ""
  keys:
    databaseUrl: DATABASE_URL
    databaseRedisUrl: DATABASE_REDIS_URL
    betterAuthSecret: BETTER_AUTH_SECRET
    denDbEncryptionKey: DEN_DB_ENCRYPTION_KEY
    daytonaApiKey: DAYTONA_API_KEY
    polarAccessToken: POLAR_ACCESS_TOKEN
    openRouterManagementApiKey: OPENROUTER_MANAGEMENT_API_KEY
    inferenceAdminToken: INFERENCE_ADMIN_TOKEN
    inferenceWebhookSecret: INFERENCE_WEBHOOK_SECRET
    emailFrom: EMAIL_FROM
    smtpHost: SMTP_HOST
    smtpPort: SMTP_PORT
    smtpUser: SMTP_USER
    smtpPass: SMTP_PASS
    smtpSecure: SMTP_SECURE
    githubConnectorAppClientSecret: GITHUB_CONNECTOR_APP_CLIENT_SECRET
    githubConnectorAppPrivateKey: GITHUB_CONNECTOR_APP_PRIVATE_KEY
    githubConnectorAppWebhookSecret: GITHUB_CONNECTOR_APP_WEBHOOK_SECRET
    connectLinkPrivateKey: DEN_CONNECT_LINK_PRIVATE_KEY
    initialAdminBootstrapCode: DEN_INITIAL_ADMIN_BOOTSTRAP_CODE
  values:
    databaseUrl: mysql://openwork:change-me@mysql:3306/openwork_den
    databaseRedisUrl: ""
    betterAuthSecret: CHANGE_ME_32_CHARS_MINIMUM_BETTER_AUTH
    denDbEncryptionKey: CHANGE_ME_32_CHARS_MINIMUM_DB_ENCRYPTION
    daytonaApiKey: ""
    polarAccessToken: ""
    openRouterManagementApiKey: ""
    inferenceAdminToken: ""
    inferenceWebhookSecret: ""
    emailFrom: ""
    smtpHost: ""
    smtpPort: "587"
    smtpUser: ""
    smtpPass: ""
    smtpSecure: "false"
    githubConnectorAppClientSecret: ""
    githubConnectorAppPrivateKey: ""
    githubConnectorAppWebhookSecret: ""
    connectLinkPrivateKey: ""
    initialAdminBootstrapCode: ""

installerArtifacts:
  enabled: false
  existingClaim: ""
  hostPath: ""
  mountPath: /var/lib/openwork/installer-artifacts

denApi:
  replicaCount: 1
  image:
    repository: ghcr.io/different-ai/openwork-den-api
    tag: ""
  service:
    type: ClusterIP
    port: 8788
    annotations: {}
    loadBalancerClass: ""
    loadBalancerSourceRanges: []
  containerPort: 8788
  env: {}
  podAnnotations: {}
  podLabels: {}
  resources: {}
  probes:
    liveness:
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 6
    readiness:
      initialDelaySeconds: 10
      periodSeconds: 5
      timeoutSeconds: 5
      failureThreshold: 12

denWeb:
  replicaCount: 1
  image:
    repository: ghcr.io/different-ai/openwork-den-web
    tag: ""
  service:
    type: ClusterIP
    port: 3005
    annotations: {}
    loadBalancerClass: ""
    loadBalancerSourceRanges: []
  containerPort: 3005
  env: {}
  podAnnotations: {}
  podLabels: {}
  resources: {}
  probes:
    liveness:
      initialDelaySeconds: 60
      periodSeconds: 10
      timeoutSeconds: 10
      failureThreshold: 6
    readiness:
      initialDelaySeconds: 20
      periodSeconds: 5
      timeoutSeconds: 10
      failureThreshold: 18

inference:
  enabled: false
  replicaCount: 1
  image:
    repository: ghcr.io/different-ai/openwork-inference
    tag: ""
  service:
    type: ClusterIP
    port: 8791
    annotations: {}
    loadBalancerClass: ""
    loadBalancerSourceRanges: []
  containerPort: 8791
  env: {}
  podAnnotations: {}
  podLabels: {}
  resources: {}
  probes:
    liveness:
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 6
    readiness:
      initialDelaySeconds: 10
      periodSeconds: 5
      timeoutSeconds: 5
      failureThreshold: 12

migrations:
  enabled: true
  hook: true
  hookDeletePolicy: before-hook-creation,hook-succeeded
  backoffLimit: 2
  activeDeadlineSeconds: 600
  podAnnotations: {}
  resources: {}
  command:
    - node
  args:
    - /app/ee/packages/den-db/dist/scripts/bootstrap.js

ingress:
  enabled: false
  className: ""
  annotations: {}
  web:
    host: openwork.example.com
    path: /
    pathType: Prefix
  api:
    enabled: true
    host: api.openwork.example.com
    path: /
    pathType: Prefix
  tls: []