# Longhorn Helm Values
defaultSettings:
    # 2 replicas so volumes survive single-node loss
    defaultReplicaCount: 2
    # Allow full disk usage on single-node
    storageOverProvisioningPercentage: 100
    storageMinimalAvailablePercentage: 10
    # Auto-salvage on node reboot (single-node)
    autoSalvage: true
    # Disable strict flushing for better single-node performance
    strictSyncReplicas: false
    # Toleration for system-managed Longhorn pods (instance-manager, engine,
    # replica, CSI plugin). These pods are created dynamically by
    # longhorn-manager — NOT from Helm templates — so their tolerations must be
    # set here via the `taintToleration` setting (semicolon-separated `kubectl
    # taint` syntax), not via per-component `tolerations` blocks.
    #
    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
    # engine/replica pods there so a volume can be failed over to the P330.
    # The control-plane taint is also tolerated defensively, although with
    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
persistence:
    defaultClass: true
    defaultClassReplicaCount: 2
    # Retain volumes on PVC delete — safer during migration
    reclaimPolicy: Retain
    # Mount options for ext4
    fstype: ext4
# longhorn-manager is a DaemonSet — it must run on every storage node,
# including the P330 failover node. The control-plane toleration is defensive
# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
# R740, but keeps things correct if that ever changes).
longhornManager:
    tolerations:
        - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
          operator: Exists
          effect: NoSchedule
        # Tolerate the failover taint so longhorn-manager runs on the P330
        - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
          value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
          operator: Equal
          effect: NoSchedule
# longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
# taints so CSI operations work from the failover node.
longhornDriver:
    tolerations:
        - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
          operator: Exists
          effect: NoSchedule
        - key: ENC[AES256_GCM,data:P+XEpfaaKMkr,iv:SY0hvYXfF6MyJYbzKcCEMaNhzoTWAbK1dYgusgTfsWM=,tag:U9M9+EeSylFKaOqmWUW6bg==,type:str]
          value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
          operator: Equal
          effect: NoSchedule
# longhorn-ui — tolerate the same taints so the UI is reachable even if it
# lands on the failover node.
longhornUI:
    replicas: 1
    tolerations:
        - key: ENC[AES256_GCM,data:k8A6ubFAYnPbFLVraOLB80iJctQEV4ffH21UceeYlMG0khgfkg==,iv:YIz/8wC36BkA6n2qKyBEp+jJhfI0mTvXz57oQC527s4=,tag:kA2c9nmLkKJMANrv6KXXPA==,type:str]
          operator: Exists
          effect: NoSchedule
        - key: ENC[AES256_GCM,data:38V7JVb5lLNy,iv:gCB4vmb9dDlOvYg2BBJyg4qzFKz6rfCNiiPZF77t2JI=,tag:rPQtsPyoVSo1CuRnB/jVGw==,type:str]
          value: ENC[AES256_GCM,data:1X3YImQC2Js=,iv:G/y3Gn1NVPoIqtezDGEahPdv8G4kepSDGipnh+kd5Xk=,tag:HgUm6SNMLp7ELXhpUwWDbw==,type:str]
          operator: Equal
          effect: NoSchedule
# Disable ingress for now
ingress:
    enabled: false
# Default backup store (NFS target on TrueNAS).
defaultBackupStore:
    # NFS endpoint exposing the TrueNAS dataset as a backup target.
    backupTarget: nfs://truenas.lan:/mnt/fast_app_data/longhorn-backup
    # No credentials required for an anonymously-readable NFS export.
    backupTargetCredentialSecret: ""
    # Poll the backup target every 5 minutes for new/removed backups.
    pollInterval: 300
sops:
    lastmodified: "2026-08-26T19:28:05Z"
    mac: ENC[AES256_GCM,data:afotIAcIgyM9YUDnvMJEVQqG2GG5+x14vbBdzg1wb2nYvJEQmLF6QRXhi7xhU59xIk7aPC+EuZmaXITc7jRJdgmr+4ovyEA0ajaRhLh22Zvhwg/WwtSOTx21PLQ8TqnKyCT+Qg/XfHimefkJM5LN09ZcmlBfAn6ycUo2rjTafho=,iv:+2UW9Ozwaezz8U/WnmcDFkKnl5HWePnWrgM++fqup1A=,tag:OlJi69lRHdWMyZXDqKUU9g==,type:str]
    pgp:
        - created_at: "2026-08-26T19:28:04Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/+N+McZCHhik9SUyO4Dk2O2/9Lu06X81x+VCgjBP99Sa4V
            bix8t+QUfkhtUhzkxWtX9NMRa8r/61xMFs6RWIfCT1pAUKerbSBuTUb6kJSaDEfW
            WvJqfAp6SHGLAi5brvcargnRXBon2uuWCMIifB5dAQWrZxSyh3Y+6QBD4bKUJAkD
            9oEJv0edWoDbVbwPxYGJTZWARXONo5wAOXJJPP8EGPmt84XK/u+s4jMDfEzeo1cA
            Uhg4+1E6IXjFCAokMgk+vPwq6YhWpUt3kjY6xUaOpF4M4z4nxAUusJrAdJ55W5Hr
            kffOrQv4h9rb9+XQDh83jdbUN+PToq81mzY2S/CutdyRDYIokFosocBay/bSRV8N
            jg/yKXzuh6NDHRgYHmIIWwxLenG2ig/JMwRCqK32NJaSAFa/aghdkLqjjNrzGFca
            DAH4xxT5g4kfER7R3TX//V+vQGOmlS/Ft3p8uuBHiKhTwTf18tKLvyqFQEqYA7D0
            eyXcsQr5P/mnWKaTrau86aYMbaBjP4DtT4hHYr2yVkY4e5IyCW7IIYjxmg0zqJoO
            oZeLk14Y+v++vCzGhglSkyiQEqCVrEhgj/JJbb2mPh/F+Ck9NSu7z54qQK7HpUx0
            fmgW0+szkfnSlzWSa8m9cSpSgIqFeH6/yuGkgrOm+e/t0pTlE8w2Sgf3KwC2qk3S
            XAGwOmmBn2FUjN/dBcjfhlJjxJS6Cb3ggJ6YnracJzJVjx+YkkIdpFYYsYs6HY98
            Fhlt9FPDs0IfH/wXQdGRF4o4e7n+YXrgPXcHEebDgQq5C+e0p3OawnvnROQQ
            =JRl3
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2