# Hub mode (the chart default): intake + registries + web UI, with
# artifacts in the release's embedded Garage store (chart default in
# hub mode, longhorn-backed). Builds happen on runners from the
# saggar-worker chart, to be paired against this hub once it is up.
image:
    repository: git.vhaudiquet.fr/saggar/saggar
    # Empty: follows the chart's appVersion — the commit SHA CI stamped
    # on the pushed images.
    tag: ""
# Private Gitea registry: the chart renders an imagePullSecret from
# these. Same access token as packages-auth-secret.yaml (the
# pre-commit sops hook encrypts this file).
imageCredentials:
    create: true
    registry: git.vhaudiquet.fr
    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
# Login via the home Gitea: the engine is the confidential client of
# the provider and runs every code exchange, so its discovery drives
# the endpoints (issuer verified live). Credentials live in
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
# id in too), so nothing sensitive renders into the ConfigMap. The UI
# needs nothing: it discovers the provider from the engine's open
# /auth/methods.
auth:
    # The web origin the device login names: `saggar login` prints the
    # confirmation page under it (saggar.dev/device).
    uiUrl: https://saggar.dev
    providers:
        - name: gitea
          issuer: https://git.vhaudiquet.fr
          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
          clientIdKey: client-id
          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
storage:
    garage:
        # Single-node store: skip the hourly self-sync cycles — while a
        # full sync runs, S3 auth lookups transiently answer
        # InvalidAccessKeyId. Weekly.
        fullSyncInterval: 604800
ingress:
    enabled: true
    className: traefik
    # The engine host: CLI intake + the docker/apt registry front-ends.
    host: api.saggar.dev
    # The chart's default annotations are nginx-specific (SSE
    # buffering); traefik streams unbuffered by default, so clear them.
    annotations: {}
    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
    # Caddy proxies to Traefik by host, so no tls block here (same as
    # pkgatlas's ingress).
    tls:
        enabled: false
ui:
    # Sign-in redirect base — the UI's own public origin.
    publicBaseUrl: https://saggar.dev
    # The engine's public origin for the docker pull / apt usage lines.
    # Set explicitly: the chart derives it from the hub ingress, whose
    # tls is off here (Caddy terminates) — that would render http://.
    apiPublicOrigin: https://api.saggar.dev
    ingress:
        enabled: true
        className: traefik
        # The UI lives on its own host: the engine mounts its API and
        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
        # pages also use.
        host: saggar.dev
        annotations: {}
        tls:
            enabled: false
docs:
    # The chart deploys the book by default; the ingress renders as
    # soon as a host is set (no enabled knob).
    ingress:
        className: traefik
        host: docs.saggar.dev
        tls:
            enabled: false
sops:
    lastmodified: "2026-10-06T04:20:10Z"
    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
    pgp:
        - created_at: "2026-10-06T04:20:10Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
            =3vCq
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2