homeprod/kubernetes/system/longhorn/values.yaml

# Longhorn Helm Values
defaultSettings:
    # 2 replicas so volumes survive single-node loss
    defaultReplicaCount: 2
    # NFS backup target on TrueNAS
    backupTarget: nfs://truenas.lan:/mnt/fast_app_data/longhorn-backup
    # Allow full disk usage on single-node
    storageOverProvisioningPercentage: 100
    storageMinimalAvailablePercentage: 10
    # Auto-salvage on node reboot (single-node)
    autoSalvage: true
    # Disable strict flushing for better single-node performance
    strictSyncReplicas: false
    # Toleration for system-managed Longhorn pods (instance-manager, engine,
    # replica, CSI plugin). These pods are created dynamically by
    # longhorn-manager — NOT from Helm templates — so their tolerations must be
    # set here via the `taintToleration` setting (semicolon-separated `kubectl
    # taint` syntax), not via per-component `tolerations` blocks.
    #
    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
    # engine/replica pods there so a volume can be failed over to the P330.
    # The control-plane taint is also tolerated defensively, although with
    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
persistence:
    defaultClass: true
    defaultClassReplicaCount: 2
    # Retain volumes on PVC delete — safer during migration
    reclaimPolicy: Retain
    # Mount options for ext4
    fstype: ext4
# longhorn-manager is a DaemonSet — it must run on every storage node,
# including the P330 failover node. The control-plane toleration is defensive
# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
# R740, but keeps things correct if that ever changes).
longhornManager:
    tolerations:
        - key: ENC[AES256_GCM,data:72tSl2wrzA+rNFPSi6y1sXNdzFd2QI9/DIoLPYv600yIWre9Jg==,iv:6FJCiqSNlTTKb0qp7Zupq6RTcwA5de8uxrFM9o8XdAw=,tag:I1gnHYR0XNgq60tOnXYFGA==,type:str]
          operator: Exists
          effect: NoSchedule
        # Tolerate the failover taint so longhorn-manager runs on the P330
        - key: ENC[AES256_GCM,data:Tru89mna++TT,iv:8gH3VLU6CCCC42SB6LfEaPY2MFHaD4cLwCWFkSHQV4A=,tag:H8gUvT97+GTgSJu7buUOjw==,type:str]
          value: ENC[AES256_GCM,data:QYHvXr+rR44=,iv:jJrfJST2MG4pC71Qr2p4WAheDHcd49DbwrBVlLFqyk0=,tag:GJHrXSKfK6/N0IWmKemZxg==,type:str]
          operator: Equal
          effect: NoSchedule
# longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
# taints so CSI operations work from the failover node.
longhornDriver:
    tolerations:
        - key: ENC[AES256_GCM,data:dQhIOMVadhzSbeJqzVBbikkKzk11GLxOHjSA1hdZkKRuKUONJA==,iv:nuurPvU/YbVdFxO+iPbWchqVNOWO+tssuF5ZhIHo8+Y=,tag:mbSWnxT6kP6ehZu1+kaAIA==,type:str]
          operator: Exists
          effect: NoSchedule
        - key: ENC[AES256_GCM,data:9dhWE/kEwWr/,iv:pXHuR05UNdJlBaCMo0T4FHPN+8qGRXFGYQglP/P/VLc=,tag:KTbwQ4KW9zsSsftXQF4DRg==,type:str]
          value: ENC[AES256_GCM,data:H6vDw998h28=,iv:IHNNLysSnMuqrmdPsCaXYFPUtGrxBFZdDFG+iOMBnvw=,tag:r1BZTI2PQ0wjhWaIi1yJZA==,type:str]
          operator: Equal
          effect: NoSchedule
# longhorn-ui — tolerate the same taints so the UI is reachable even if it
# lands on the failover node.
longhornUI:
    replicas: 1
    tolerations:
        - key: ENC[AES256_GCM,data:deSbcZL4q+7tZaTg2pE1Ssq/WG0aS29EYAW+y1/Vl4Uq3E4tDQ==,iv:mE3AYFNrs7aAdKG1eRMJ21AwVdspJq42zWqytehn9z0=,tag:DsC7ehN8NhANSzWBQ3rMjQ==,type:str]
          operator: Exists
          effect: NoSchedule
        - key: ENC[AES256_GCM,data:4UJN0oQsnPgz,iv:bnCs9OQzRNYxZS4LMVcI5Zgel4MES745e47/Wc+72Ps=,tag:+WD085TKD5CfFYJ3B0RotA==,type:str]
          value: ENC[AES256_GCM,data:preRO+Om90c=,iv:Q6VF0hDh5Jz3ghB+VqUB/KO5i2wwxq68WWLq2ptnwOQ=,tag:ug333G7gCkSn60g/Lo5S7A==,type:str]
          operator: Equal
          effect: NoSchedule
# Disable ingress for now
ingress:
    enabled: false
# Recurring backup and snapshot schedules
# - Daily snapshots: fast local recovery from accidental deletes
# - Daily NFS backups: DR if node is lost
recurringJobs:
    enable: true
    jobs:
        - name: daily-snapshot
          task: snapshot
          cron: 0 2 * * *
          retain: 7
          concurrency: 2
          labels:
            type: snapshot
        - name: daily-backup
          task: backup
          cron: 0 3 * * *
          retain: 7
          concurrency: 2
          labels:
            type: backup
sops:
    lastmodified: "2026-07-25T12:52:04Z"
    mac: ENC[AES256_GCM,data:iYSrt+E3ZBR/x85S4A/Y4GalkJ5Y0NDwjSvh6Pfa8d5Qz+uFdGofnNISS7QgqmsGpLbLKMFHRxLV6L3R85V/o293SfNA/+iM8DXOoZTb8zQTLsPxjqxr8Hfl0cxBgV8LgZJzzG8pkeONDfqqtF6pGMgAz0SHfdAR2qdbCKTztis=,iv:YdWgVo9/YlusV1mqBWpVQVVdEQGSD7ytPVNJYjppmTw=,tag:XOxeIx5GWJcZD19zZTe5YQ==,type:str]
    pgp:
        - created_at: "2026-07-25T12:52:04Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAgDIE7tPjU9uheakXKYvn6IyNKkZjXTnV2sBPdoo4l0SW
            ZYAu+L9SKnVKpmuQxz3HKqk/9Cib7Q/g9HdrXsrLkQ0xS6BC+4z+4JynxWHN3CII
            0w7SNKVFV4RIXWwMQe0Hg+2OtzXyF1g8ZmNZu/L+/kusEnl7WX9BoYOB5i5wssM/
            Nfb7LTlMGqmyQoWxbTzkdNuMbw2oVjD6pgL/VEpfCmvVzMpXScmTT9tFdJRYDuj6
            r9a8wkFzCHNUWy3z7+00cQVnyDBA/UY/9pskeR58QH4keXp5xeBIYKxUe28L9JRg
            YkVJjy1XFmmdY6VWmMo/Sx89YUQ9kMpf9KI/D0WkgGLqTihzsX4v7xxvWJfYXiPd
            RmkRR4f19HfUapLzosO65rtYAG3BptdRPBpvx77evLkPwps34+dxUrVESYxY/I01
            0BNNLDthEhBzfmh/yz3BcYOigZp1ziiXq201pn+qiDbLSDeoidm0IrN+g3Kib25g
            dBTpRD3iEoBXeW2kbwltoUwsNkv59Gf/fj3DUQFAclP56b7UzRLDCQKiKIL17l2O
            nU6yvz9iARPYvT3gzqOw8yaB780RQejR+8qiZca0WetNcVn7b+DMGpKgQXnchc1g
            WzI3MdpNtajQGwBtHic3BG4xYAoN6sNmVrz+aGBIkBxFK3nMBzeWQJBSm6iiEwzS
            XgFcb1jlb7dC/g8ltmAIOyjwnFHkfVI2/v+u+E1mW2VWBQqtABAHobh6uEf1jFzj
            DZubFTVfrI4ssrvsjhm84mVJND9taaLPU4qbVYJ8G4kmP8UyKdHd1fJifNdp9+o=
            =qY6k
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2