values.yaml

fullnameOverride: ""

replicaCount: 1

image:
  repository: ghcr.io/hrodrig/gghstats
  tag: "v1.0.1"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  # Service port (e.g. 80 for Traefik ingress). Container listens on env.port (8080).
  port: 8080
  targetPort: 8080

env:
  host: "0.0.0.0"
  # Must match service.targetPort.
  port: "8080"
  # SQLite path — must be under the /data volume (only writable mount besides /tmp).
  dbPath: "/data/gghstats.db"
  filter: "*"
  includePrivate: "false"
  syncInterval: "1h"
  # Optional (gghstats >= 0.5.0): "true" or "false"; empty = app default (true).
  syncOnStartup: ""
  # UI i18n (gghstats >= 0.6.0); API/CLI stay English.
  defaultLocale: "en"
  enabledLocales: "en,es,de,fr,pt-br"
  # Optional (gghstats >= 0.3.0): badge embeds and public base URL behind ingress.
  badgePublic: ""
  publicUrl: ""
  # API token for protected endpoints and sync UI. REQUIRED for the "Sync now"
  # button to appear in the dashboard sidebar. Can be any string; the same value
  # is sent as x-api-token header. If empty, the sync button is hidden and
  # /api/ endpoints return 404.
  apiToken: ""
  # Optional: path inside container to a .css file under /data (gghstats >= 0.2.0). Example: "/data/custom-theme.css".
  customCss: ""
  # Log level: debug, info, warn, error (gghstats >= 0.2.0). Empty = app default (info).
  logLevel: ""
  # Leave empty for default (Prometheus /metrics enabled). Set to "false" to disable.
  metrics: ""
  # Leave empty for default (off). Set to "true" for per-repo gauges (gghstats >= 0.4.0).
  metricsPerRepo: ""
  # Per-IP rate limiting (gghstats >= 0.7.5). Enabled by default; set "false" to disable.
  rateLimitEnabled: ""
  rateLimitRequests: ""
  rateLimitPeriod: ""
  rateLimitBurst: ""
  # Trusted reverse-proxy peers for X-Forwarded-For / X-Real-IP (gghstats >= 0.10.2).
  # Empty = ignore forwarded headers. Behind Ingress/Traefik set the proxy CIDR(s).
  trustedProxies: ""
  # Raw HTML injected just before </head> on every page (gghstats >= 0.7.11).
  # Useful for analytics scripts, extra CSS, meta tags, etc.
  headHTML: ""
  # JSON array of reverse-proxy rules (gghstats >= 0.7.11).
  # Each rule maps a local path prefix to a remote backend, with optional headers.
  # Example: '[{"local":"/kiko","url":"https://events.example.com","headers":{"Host":"kiko-backend"}}]'
  reverseProxyRules: ""
  # Anonymous usage collection (gghstats >= 0.7.11). Set "true" to enable;
  # empty = disabled. Sends anonymous feature-flag data on startup (no secrets,
  # paths, or repo names).
  enableCollector: ""
  # Update check (gghstats >= 0.7.11). Checks GitHub API for newer releases on
  # startup and logs a warning. empty = app default (enabled). Set "false" to disable.
  enableUpdateCheck: ""
  # Number of concurrent workers for GitHub API sync (gghstats >= 0.8.0). empty = app default (4).
  syncWorkers: ""
  # Demo UI with sample data (gghstats >= 0.9.0). Set "true" for no GitHub token/sync.
  # empty = off. For production leave empty and set githubToken.
  demo: ""


# Opt-in alerts (gghstats >= 0.10.0; SMTP >= 0.10.2).
# `sinks` and `rules` are JSON arrays. Provider credentials belong in an
# existing Kubernetes Secret whose keys are environment-variable names, e.g.
# GGHSTATS_SLACK_WEBHOOK_URL, GGHSTATS_TEAMS_WEBHOOK_URL, GGHSTATS_SMTP_PASSWORD.
alerting:
  enabled: false
  sinks: ""
  rules: ""
  existingSecret: ""

githubToken:
  existingSecret: ""
  secretName: gghstats-secret
  secretKey: github-token
  value: ""

persistence:
  enabled: true
  size: 5Gi
  storageClass: ""
  accessModes:
    - ReadWriteOnce
  # Note: the PVC has helm.sh/resource-policy: keep, so it is NOT deleted on helm uninstall.
  # To remove it manually: kubectl delete pvc <name>

# Required shape is enforced by values.schema.json (Helm rejects missing or incomplete resources).
# Baseline for scheduling (requests) and burst cap (limits). Tune for your traffic and GitHub sync load.
resources:
  requests:
    cpu: 50m
    memory: 128Mi
  limits:
    cpu: "1"
    memory: 512Mi

# Must match the non-root user in the upstream image (see gghstats Dockerfile: USER gghstats, uid/gid 1000).
imagePullSecrets: []

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL

nodeSelector: {}
tolerations: []
affinity: {}