# Hub mode (the chart default): intake + registries + web UI, with
# artifacts in the release's embedded Garage store (chart default in
# hub mode, longhorn-backed). Builds happen on runners from the
# saggar-worker chart, to be paired against this hub once it is up.
image:
    repository: git.vhaudiquet.fr/saggar/saggar
    # Empty: follows the chart's appVersion — the commit SHA CI stamped
    # on the pushed images.
    tag: ""
# Private Gitea registry: the chart renders an imagePullSecret from
# these. Same access token as packages-auth-secret.yaml (the
# pre-commit sops hook encrypts this file).
imageCredentials:
    create: true
    registry: git.vhaudiquet.fr
    username: ENC[AES256_GCM,data:/BEuQFoDxyFVzQ==,iv:O4X+Q3DhkCItIHABBrHYRI842vI86NTmAx1jEtIrOrw=,tag:+H6KUFV4H+uDAyBxEbsj6g==,type:str]
    password: ENC[AES256_GCM,data:S88PWTFhnBeDK+ofX9AOJLeuM+YN1tnd2IL453Mv4gk0Rbr4ttTgcQ==,iv:7UFDQn1VZG7e/z/Su1lOJeMgnNzWYevv9PoCOPSA810=,tag:eyFF74hIY4Tj6zoBpvhJ+w==,type:str]
# Login via the home Gitea: the engine is the confidential client of
# the provider and runs every code exchange, so its discovery drives
# the endpoints (issuer verified live). Credentials live in
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
# id in too), so nothing sensitive renders into the ConfigMap. The UI
# needs nothing: it discovers the provider from the engine's open
# /auth/methods.
auth:
    providers:
        - name: gitea
          issuer: https://git.vhaudiquet.fr
          existingSecret: ENC[AES256_GCM,data:QU4XxTO9yYTtAD1DIVrHeHs=,iv:R63SB9qZqCoI2VThliV1jobCMmGYJw+GKwfRp0CSMz0=,tag:TjFWZdjsfm0AgqPRbv5uBQ==,type:str]
          clientIdKey: client-id
          clientSecretKey: ENC[AES256_GCM,data:NCzGSzyzi1sK0L2AFA==,iv:t9JRUnHCEMedeW/+IXWKY4XDCweJIi7MDYI5EBtpvQE=,tag:uSX2qj8ZoQbW9Iww1Y3NNQ==,type:str]
ingress:
    enabled: true
    className: traefik
    # The engine host: CLI intake + the docker/apt registry front-ends.
    host: api.saggar.dev
    # The chart's default annotations are nginx-specific (SSE
    # buffering); traefik streams unbuffered by default, so clear them.
    annotations: {}
    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
    # Caddy proxies to Traefik by host, so no tls block here (same as
    # pkgatlas's ingress).
    tls:
        enabled: false
ui:
    # Sign-in redirect base — the UI's own public origin.
    publicBaseUrl: https://saggar.dev
    # The engine's public origin for the docker pull / apt usage lines.
    # Set explicitly: the chart derives it from the hub ingress, whose
    # tls is off here (Caddy terminates) — that would render http://.
    apiPublicOrigin: https://api.saggar.dev
    ingress:
        enabled: true
        className: traefik
        # The UI lives on its own host: the engine mounts its API and
        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
        # pages also use.
        host: saggar.dev
        annotations: {}
        tls:
            enabled: false
sops:
    lastmodified: "2026-09-30T20:30:47Z"
    mac: ENC[AES256_GCM,data:jo02sAVCmt1qO+2DUOjWSAXo47OzviRvz/GEX7hU/g4U1CyhKP/zHxoAIeCAOVnL4DJ+w0ayYuU16Im/iFa2tVnvpRVhVpnUgDgin11EukeLizUodAbm9mmsdBqlivrRxjf7yj8Czg6VOHHtcUMLQcXIgwTZ2GoSotXN7EBp+FM=,iv:149oaU4BK7gjgb0mZPMrB62L4KxbeQyVtW0r8Ox7BKg=,tag:hnVG7Wg/zGiGl1KjO8olCA==,type:str]
    pgp:
        - created_at: "2026-09-30T20:30:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAnlK3L9KylJuKOT8XrUI7L7ax+K2XEqQh3bXtByc1y1ns
            ka5iGUuuMT00T88y0J1DuOiGj51WiZtKyr1pOVmqsS/uVYXE7FruR2A/KWrZEVG0
            wb8UuPP/TWbo8vc3uvq/ivTv70CnfjGI43uv12r51EsIbCvnSikI6p5tAzX8bwoI
            Ei/wQexFlz82Vc0qZ0Dmw6aa1pkDBrN5jIW47WPRUnFwpejdA5ZsvdeBxeeiPJXh
            iXMbqp9R2A5615WdZaVoSzSTacRk4LU3zcDhGWkr7ja37+BYer9ZBbNrh/tA4GH5
            EjmbNkmR6A5Ra3TII8/B4ycqwhShuyjSV6bj+TCV2J8VGCvI+20PIcDP8SGIBhLg
            JHmpGTwc2pjRD4Ekgt6rrOoKYLpP16ooEbqdxHmzhWHfKCI8v6yinSaU3Lz9vXL5
            TeRCZ9fIZB5zXE1nEeAFCGHfOV/HQCP9Z1/x8EsflH0SYosx/jjOUFSP8Q+AsJ/+
            ompNtICXVliM1jsebhGNwBdadfe/8T1M/zwdof/XY+6myKGNxhxFNbq/B92Ppwo9
            KYYCImMgLRUKjQLgBqJrzL6jkqWUwGpCfcgdsZQyFLzGzUIkbCITPCNLiMb195PS
            ruJ2NJZA4YCZ8OapzBRI7KFAH+s00ipE25wK85zsS3f41RwZKHG0XE09l/bJFDTS
            XAEA78VEJxsCtdMHtSX2cGvDOc5PGT8qDwvn5O8ubDjPN11u1rL24yYdzEsHEzbL
            F0TT5R7s5FQk1YOCzXVaFOKFEnpU4STRm9uYKP7SUYJUyT/TzzNu5iYaachA
            =Y1SN
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2