89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
# AWS EKS Auto Mode HTTP smoke-test values for a first OpenWork EE install when
|
|
# DNS and ACM TLS are not ready yet.
|
|
#
|
|
# Copy this file, replace every REPLACE_* value, and install with:
|
|
#
|
|
# helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
|
|
# --version REPLACE_OPENWORK_VERSION \
|
|
# --namespace openwork-ee \
|
|
# --create-namespace \
|
|
# -f values.aws-http-smoke.yaml
|
|
#
|
|
# This creates two public AWS Network Load Balancers on clear HTTP ports. After
|
|
# the first successful install, replace the pending origins with the real NLB
|
|
# hostnames, run helm upgrade again, and then validate browser auth. Prefer the
|
|
# HTTPS/ACM example for production.
|
|
|
|
image:
|
|
tag: "REPLACE_OPENWORK_VERSION"
|
|
pullPolicy: IfNotPresent
|
|
|
|
config:
|
|
tenancy:
|
|
mode: single_org
|
|
singleOrgName: "REPLACE_COMPANY_NAME"
|
|
singleOrgSlug: "REPLACE_COMPANY_SLUG"
|
|
ownerEmails: "REPLACE_ADMIN_EMAIL"
|
|
allowPublicSignup: "false"
|
|
requireEmailVerification: "false"
|
|
auth:
|
|
passwordBreachScreeningEnabled: "false"
|
|
public:
|
|
webOrigin: "http://pending-web-nlb:3005"
|
|
apiOrigin: "http://pending-api-nlb:8788"
|
|
mcpResourceUrl: "http://pending-api-nlb:8788/mcp"
|
|
mcpClaimNamespace: "http://pending-web-nlb:3005"
|
|
desktopDenBaseUrl: "http://pending-web-nlb:3005"
|
|
corsOrigins: "http://pending-web-nlb:3005,http://pending-api-nlb:8788"
|
|
betterAuthTrustedOrigins: "http://pending-web-nlb:3005"
|
|
webAppHosts: "pending-web-nlb"
|
|
bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
|
|
authCallbackUrl: "http://pending-web-nlb:3005"
|
|
provisioner:
|
|
mode: stub
|
|
|
|
secret:
|
|
create: true
|
|
values:
|
|
# RDS MySQL private-network smoke path. sslaccept=accept preserves TLS but
|
|
# does not require the RDS CA chain to be mounted into the image.
|
|
databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_RDS_ENDPOINT:3306/openwork_den?sslaccept=accept"
|
|
# Generate with: openssl rand -base64 48
|
|
betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
|
|
# Generate separately with: openssl rand -base64 48
|
|
denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
|
|
|
|
denApi:
|
|
replicaCount: 1
|
|
service:
|
|
type: LoadBalancer
|
|
port: 8788
|
|
loadBalancerClass: eks.amazonaws.com/nlb
|
|
annotations:
|
|
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
|
|
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
|
|
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
|
|
service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /ready
|
|
|
|
denWeb:
|
|
replicaCount: 1
|
|
service:
|
|
type: LoadBalancer
|
|
port: 3005
|
|
loadBalancerClass: eks.amazonaws.com/nlb
|
|
annotations:
|
|
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
|
|
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
|
|
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
|
|
service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /api/ready
|
|
|
|
inference:
|
|
enabled: false
|
|
|
|
migrations:
|
|
enabled: true
|
|
hook: true
|
|
|
|
ingress:
|
|
enabled: false
|