# GKE production values overlay for knoe-supabase Helm chart.
#
# Apply on top of values.yaml:
#   helm upgrade --install knoe-supabase ./supabase/helm/knoe-supabase \
#     --values supabase/helm/knoe-supabase/values.yaml \
#     --values supabase/helm/knoe-supabase/values-gke.yaml \
#     --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID="$CLIENT_ID" \
#     --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_SECRET="$CLIENT_SECRET" \
#     --set environment.auth.GOTRUE_SITE_URL="https://$FRONTDOOR_HOST" \
#     --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="https://$FRONTDOOR_HOST/auth/v1/callback" \
#     --set environment.auth.GOTRUE_URI_ALLOW_LIST="https://$FRONTDOOR_HOST/**"
#
# Or set FRONTDOOR_HOST, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET in environment
# and let init_supabase.sh --mode k8s substitute them automatically.

# ── Storage: use GCS instead of bundled MinIO ───────────────────────────────
# When CNPG Workload Identity is active the pod SA already has storage access;
# set storage driver to gcs and disable minio.
deployment:
  minio:
    enabled: false

# ── GoTrue: enable Google OAuth via knoe-auth OIDC broker ───────────────────
environment:
  auth:
    # Override base URL to the GKE frontdoor
    API_EXTERNAL_URL: ""     # set to https://<frontdoor-host>/auth/v1 at deploy time
    GOTRUE_SITE_URL: ""      # set to https://<frontdoor-host>
    GOTRUE_URI_ALLOW_LIST: ""  # set to https://<frontdoor-host>/**

    # Google OAuth2 — client ID and secret from knoe-auth-google-oidc secret
    GOTRUE_EXTERNAL_GOOGLE_ENABLED: "true"
    GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ""      # injected at deploy time
    GOTRUE_EXTERNAL_GOOGLE_SECRET: ""         # injected at deploy time
    GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ""   # set to https://<frontdoor-host>/auth/v1/callback

    # Disable anonymous sign-in in production
    GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "false"

    # Auto-confirm email (Google accounts are pre-verified)
    GOTRUE_MAILER_AUTOCONFIRM: "true"

# ── Studio: oauth2-proxy for Google Workspace OIDC login ────────────────────
# Replaces the basic-auth popup with a proper Google login page.
# Credentials are injected at deploy time via secretRef (see conf/gke.cfg:
#   DB_OIDC_CLIENT_ID     = secretref://db-oidc-client-id
#   DB_OIDC_CLIENT_SECRET = secretref://db-oidc-client-secret
#   DB_OIDC_COOKIE_SECRET = secretref://db-oidc-cookie-secret)
#
# To create the Google OAuth client:
#   GCP Console → APIs & Services → Credentials → Create OAuth Client
#   Type: Web application, name: "knoe.dev Supabase Studio"
#   Redirect URI: https://db.0.knoe.dev/oauth2/callback
deployment:
  oauth2proxy:
    enabled: true
    emailDomain: "knoey.com"
    redirectUrl: "https://db.0.knoe.dev/oauth2/callback"

secret:
  dashboard: ~    # disables basic-auth Kong consumer when oauth2proxy is active
  oauth2proxy:
    secretRef: ""          # set to a pre-existing secret name, or leave blank to use
    clientId: ""           # DB_OIDC_CLIENT_ID (injected at deploy time via secretref)
    clientSecret: ""       # DB_OIDC_CLIENT_SECRET
    cookieSecret: ""       # DB_OIDC_COOKIE_SECRET

# ── Ingress: use GKE-managed ingress class ──────────────────────────────────
ingress:
  studio:
    className: "gce"    # GKE L7 load balancer; override with "kong" if Kong is installed