# ============================================================================
# Hindsight — helm values (Phase C). Consumed by the ArgoCD Application source 1
# via `helm.valueFiles: ["$values/values.yaml"]` (openviking multi-source pattern).
#
# Design decisions (all verified against chart v0.9.1 + rendered output):
#   - Chart is the single source for the app (api, control-plane, services,
#     probes, ingress). We do NOT hand-roll Deployments/Services.
#   - Postgres is EXTERNAL (separate Deployment in this dir, firecrawl pattern)
#     => postgresql.enabled: false, external.* points at hindsight-postgres:5432.
#   - Secrets come from 1Password via ExternalSecret => existingSecret:
#     hindsight-credentials. The chart does envFrom(secretRef) so
#     HINDSIGHT_API_LLM_API_KEY / HINDSIGHT_API_MCP_AUTH_TOKEN are injected
#     automatically; POSTGRES_PASSWORD is a secretKeyRef that K8s expands into
#     HINDSIGHT_API_DATABASE_URL (verified with a live envFrom test pod).
#   - LLM is the Nous free-tier inference endpoint
#     (https://inference-api.nousresearch.com/v1), model
#     `stepfun/step-3.7-flash:free` (mandatory reasoning, 262K ctx). Fallback
#     (documented, NOT deployed): `solar-pro4:free`. API key via existingSecret
#     envFrom (hindsight-credentials / HINDSIGHT_API_LLM_API_KEY), sourced from
#     1Password `nous` item per decision 4.
#   - Ingress is driven through the chart's NATIVE ingress template (approved
#     plan: "Ingress driven through values.yaml"). api.service.port=8888,
#     controlPlane.service.port=3000.
#   - Image tag defaults to .Values.version (root) when api.image.tag is unset,
#     so version: "0.9.1" pins the API image to 0.9.1.
# ============================================================================

version: "0.9.1"

# ----------------------------------------------------------------------------
# External PostgreSQL (chart's bundled postgresql is disabled).
# password is the K8s env expansion `$(POSTGRES_PASSWORD)` — the chart defines
# POSTGRES_PASSWORD as a secretKeyRef (hindsight-credentials / postgres-password)
# earlier in the same container, so K8s substitutes it at container start.
# ----------------------------------------------------------------------------
postgresql:
  enabled: false
  external:
    host: hindsight-postgres
    port: 5432
    username: hindsight
    database: hindsight
    password: $(POSTGRES_PASSWORD)

# ExternalSecret (from 1Password) that the chart injects via envFrom(secretRef).
# Keys it must expose: postgres-password, HINDSIGHT_API_LLM_API_KEY,
# HINDSIGHT_API_MCP_AUTH_TOKEN. See externalsecret.yaml in this dir.
existingSecret: hindsight-credentials

# ----------------------------------------------------------------------------
# API container environment (explicit env entries; the chart renders this map
# to individual env vars). LLM points at the Nous free-tier inference API
# (OpenAI-compatible). HINDSIGHT_API_LLM_API_KEY is NOT set here — it comes from
# the existingSecret via envFrom (1Password `nous` item).
# ----------------------------------------------------------------------------
api:
  env:
    HINDSIGHT_API_LLM_BASE_URL: "https://inference-api.nousresearch.com/v1"
    HINDSIGHT_API_LLM_PROVIDER: "openai"
    # Primary LLM. Fallback (documented, NOT deployed): solar-pro4:free
    HINDSIGHT_API_LLM_MODEL: "stepfun/step-3.7-flash:free"

# ----------------------------------------------------------------------------
# Ingress via the chart's native template.
#   /health,/v1,/mcp,/ext  -> api:8888        (longest-prefix wins in nginx)
#   /                      -> controlPlane:3000
# TLS secret hindsight-tls provisioned by the letsencrypt-prod issuer.
# ----------------------------------------------------------------------------
ingress:
  enabled: true
  className: "nginx"
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
  hosts:
    - host: cosmic-rewind.local.mk-labs.cloud
      paths:
        - path: /health
          pathType: Prefix
          service: api
        - path: /v1
          pathType: Prefix
          service: api
        - path: /mcp
          pathType: Prefix
          service: api
        - path: /ext
          pathType: Prefix
          service: api
        - path: /
          pathType: Prefix
          service: controlPlane
  tls:
    - hosts:
        - cosmic-rewind.local.mk-labs.cloud
      secretName: hindsight-tls