100 lines
3.1 KiB
YAML
100 lines
3.1 KiB
YAML
# Azure AKS starter values for a first OpenWork EE self-host install.
|
|
#
|
|
# Follow docs/azure-aks-helm.md to create the VNet, AKS subnet, delegated
|
|
# MySQL subnet, AKS cluster, and Azure Database for MySQL Flexible Server.
|
|
# Then copy this file, replace every REPLACE_* value, and install with:
|
|
#
|
|
# helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
|
|
# --version REPLACE_OPENWORK_VERSION \
|
|
# --namespace openwork-ee \
|
|
# --create-namespace \
|
|
# -f values.azure.yaml
|
|
#
|
|
# This example exposes Den Web and Den API through the AKS application routing
|
|
# add-on's managed NGINX Ingress controller. Use it for production-like Azure
|
|
# tests where browser auth and SSO need stable HTTPS hostnames.
|
|
|
|
image:
|
|
tag: "REPLACE_OPENWORK_VERSION"
|
|
pullPolicy: IfNotPresent
|
|
|
|
config:
|
|
tenancy:
|
|
mode: single_org
|
|
singleOrgName: "REPLACE_COMPANY_NAME"
|
|
singleOrgSlug: "REPLACE_COMPANY_SLUG"
|
|
ownerEmails: "REPLACE_ADMIN_EMAIL"
|
|
allowPublicSignup: "false"
|
|
requireEmailVerification: "false"
|
|
auth:
|
|
passwordBreachScreeningEnabled: "false"
|
|
public:
|
|
webOrigin: "https://REPLACE_WEB_HOST"
|
|
# Split-origin compatibility override for this two-host ingress example.
|
|
# Leave blank in single-origin deployments so Den derives it from webOrigin.
|
|
apiOrigin: "https://REPLACE_API_HOST"
|
|
mcpResourceUrl: "https://REPLACE_API_HOST/mcp"
|
|
mcpClaimNamespace: "https://REPLACE_WEB_HOST"
|
|
desktopDenBaseUrl: ""
|
|
corsOrigins: "https://REPLACE_WEB_HOST,https://REPLACE_API_HOST"
|
|
betterAuthTrustedOrigins: "https://REPLACE_WEB_HOST"
|
|
webAppHosts: "REPLACE_WEB_HOST"
|
|
bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
|
|
authCallbackUrl: "https://REPLACE_WEB_HOST"
|
|
provisioner:
|
|
mode: stub
|
|
|
|
secret:
|
|
create: true
|
|
values:
|
|
# Azure Database for MySQL Flexible Server private-network smoke path.
|
|
# sslaccept=accept preserves TLS without requiring a mounted CA bundle.
|
|
databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_MYSQL_SERVER_NAME.mysql.database.azure.com:3306/openwork_den?sslaccept=accept"
|
|
# Generate with: openssl rand -base64 48
|
|
betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
|
|
# Generate separately with: openssl rand -base64 48
|
|
denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
|
|
# One-time /setup code. Generate a unique value and keep it out of source control.
|
|
initialAdminBootstrapCode: "REPLACE_BOOTSTRAP_CODE"
|
|
# Optional SMTP settings for invitations and other transactional email.
|
|
# SMTP delivery requires both emailFrom and smtpHost.
|
|
emailFrom: "OpenWork <no-reply@example.com>"
|
|
smtpHost: ""
|
|
smtpPort: "587"
|
|
smtpUser: ""
|
|
smtpPass: ""
|
|
smtpSecure: "false"
|
|
|
|
denApi:
|
|
replicaCount: 1
|
|
service:
|
|
type: ClusterIP
|
|
port: 8788
|
|
|
|
denWeb:
|
|
replicaCount: 1
|
|
service:
|
|
type: ClusterIP
|
|
port: 3005
|
|
|
|
inference:
|
|
enabled: false
|
|
|
|
migrations:
|
|
enabled: true
|
|
hook: true
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: webapprouting.kubernetes.azure.com
|
|
web:
|
|
host: REPLACE_WEB_HOST
|
|
api:
|
|
enabled: true
|
|
host: REPLACE_API_HOST
|
|
tls:
|
|
- secretName: openwork-ee-tls
|
|
hosts:
|
|
- REPLACE_WEB_HOST
|
|
- REPLACE_API_HOST
|