image:
  repository: ghcr.io/mastodon/mastodon
  tag: v4.7.3
  pullPolicy: IfNotPresent

mastodon:
  locale: en
  localDomain: brunner.ninja
  webDomain: social.brunner.ninja
  singleUserMode: true
  authorizedFetch: false
  limitedFederationMode: false

  createAdmin:
    enabled: false

  secrets:
    existingSecret: mastodon-secrets

  s3:
    enabled: true
    hostname: s3.brunner.ninja
    endpoint: http://rook-ceph-rgw-my-store.rook-ceph.svc.cluster.local
    protocol: https
    region: keller
    bucket: mastodon
    existingSecret: mastodon-s3
    aliasHost: s3.brunner.ninja/mastodon
    # Mastodon maps this legacy flag inversely to aws-sdk's force_path_style.
    # "false" is required for an in-cluster Ceph RGW endpoint.
    overridePathStyle: "false"

  pvc:
    enabled: false

  smtp:
    domain: brunner.ninja
    fromAddress: social@brunner.ninja
    replyTo: daniel@brunner.ninja
    server: smtp-relay.gmail.com
    port: 587
    authMethod: none
    enableStartTls: auto
    opensslVerifyMode: peer
    tls: false
    existingSecret: mastodon-smtp

  web:
    replicas: 1
    resources:
      requests:
        cpu: 250m
        memory: 768Mi
      limits:
        cpu: "2"
        memory: 2Gi

  sidekiq:
    workers:
      - name: all-queues
        replicas: 1
        concurrency: 15
        queues:
          - default,8
          - push,6
          - ingress,4
          - mailers,2
          - pull
          - scheduler
          - fasp
        resources:
          requests:
            cpu: 250m
            memory: 768Mi
          limits:
            cpu: "2"
            memory: 2Gi
    readinessProbe:
      enabled: true

  streaming:
    replicas: 1
    workers: 1
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: "1"
        memory: 768Mi

  extraEnvVars:
    TZ: Europe/Vienna
    ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH: "true"
    ONE_CLICK_SSO_LOGIN: "true"
    # Ceph RGW maps this S3 storage class to my-store.rgw.buckets.ec.
    S3_STORAGE_CLASS: STANDARD_IA

service:
  type: ClusterIP

ingress:
  enabled: true
  className: traefik
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: social.brunner.ninja
      paths:
        - path: /
          pathType: Prefix
  tls: []

httproute:
  enabled: false

postgresql:
  hostname: mastodon-postgresql-rw.mastodon.svc.cluster.local
  port: 5432
  database: mastodon
  existingSecret: mastodon-postgresql-app

redis:
  hostname: valkey.mastodon.svc.cluster.local
  port: 6379
  existingSecret: valkey-auth

elasticsearch:
  enabled: false

externalAuth:
  oidc:
    enabled: true
    displayName: brunner.ninja Auth
    issuer: https://auth.brunner.ninja/application/o/mastodon/
    discovery: true
    scope: openid,profile,email
    uidField: preferred_username
    existingSecret: mastodon-oidc
    redirectUri: https://social.brunner.ninja/auth/auth/openid_connect/callback
    assumeEmailIsVerified: true
  oauthGlobal:
    omniauthOnly: true

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: "1"
    memory: 1Gi