# -----------------------------------------------------------
# Security contexts (dev-only: run as root, no restrictions)
# -----------------------------------------------------------

.podSecurityContext: &podSecurityContext
  runAsUser: 0
  runAsGroup: 0
  fsGroup: 0
  runAsNonRoot: false
  seccompProfile:
    type: RuntimeDefault

.securityContext: &securityContext
  allowPrivilegeEscalation: true
  capabilities:
    drop: []

# -----------------------------------------------------------
# Shared anchors
# -----------------------------------------------------------

_summaryEnvVars: &summaryEnvVars
  APP_NAME: summary-microservice
  APP_API_TOKEN: password
  AWS_STORAGE_BUCKET_NAME: meet-media-storage
  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
  AWS_S3_ACCESS_KEY_ID: meet
  AWS_S3_SECRET_ACCESS_KEY: password
  AWS_S3_SECURE_ACCESS: False
  AUTHORIZED_TENANTS: '[{"id": "dictaphone", "api_key": "dictaphone_token", "webhook_url": "http://dictaphone-backend.dictaphone.svc.cluster.local/api/v1.0/ai-jobs/webhook/", "webhook_api_key": "token_summary"}]'
  WHISPERX_API_KEY:
    secretKeyRef:
      name: secret-dev
      key: WHISPERX_API_KEY
  WHISPERX_BASE_URL:
    secretKeyRef:
      name: secret-dev
      key: WHISPERX_BASE_URL
  WHISPERX_ASR_MODEL: large-v2
  WHISPERX_DEFAULT_LANGUAGE: fr
  LLM_BASE_URL:
    secretKeyRef:
      name: secret-dev
      key: LLM_BASE_URL
  LLM_API_KEY:
    secretKeyRef:
      name: secret-dev
      key: LLM_API_KEY
  LLM_MODEL: Qwen/Qwen3-Coder-30B-A3B-Instruct
  WEBHOOK_API_TOKEN: password
  WEBHOOK_URL: https://www.mock-impress.com/webhook/
  CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
  CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
  TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1

_summaryImage: &summaryImage
  repository: localhost:5001/meet-summary
  pullPolicy: Always
  tag: "latest"

# -----------------------------------------------------------
# Shared component definitions
# -----------------------------------------------------------
image:
  repository: localhost:5001/meet-backend
  pullPolicy: Always
  tag: "latest"

backend:
  replicas: 1
  # envVars must be completed in per-env overlay (merge base + specifics)

  migrate:
    command:
      - "/bin/sh"
      - "-c"
      - |
        python manage.py migrate --no-input
    restartPolicy: Never

  command:
    - "gunicorn"
    - "-c"
    - "/usr/local/etc/gunicorn/meet.py"
    - "meet.wsgi:application"
    - "--reload"

  createsuperuser:
    command:
      - "/bin/sh"
      - "-c"
      - |
        python manage.py createsuperuser --email admin@example.com --password admin
    restartPolicy: Never

  extraVolumeMounts:
    - name: certs
      mountPath: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
      subPath: cacert.pem

  extraVolumes:
    - name: certs
      configMap:
        name: certifi
        items:
          - key: cacert.pem
            path: cacert.pem

  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

frontend:
  replicas: 1
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

ingress:
  enabled: true
  host: meet.127.0.0.1.nip.io

ingressAdmin:
  enabled: true
  host: meet.127.0.0.1.nip.io

ingressWebhook:
  enabled: true
  host: meet.127.0.0.1.nip.io

posthog:
  ingress:
    enabled: false
  ingressAssets:
    enabled: false

ingressMedia:
  enabled: true
  host: meet.127.0.0.1.nip.io
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1

serviceMedia:
  host: minio.meet.svc.cluster.local
  port: 9000

summary:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

celeryTranscribe:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext
  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "transcribe-queue,transcribe-queue-v2"

celerySummarize:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext
  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "summarize-queue,summarize-queue-v2"

celerySummaryBackend:
  replicas: 1
  image: *summaryImage
  envVars:
    <<: *summaryEnvVars
  podSecurityContext: *podSecurityContext
  securityContext: *securityContext

  command:
    - "celery"
    - "-A"
    - "summary.core.celery_worker"
    - "worker"
    - "--pool=solo"
    - "--loglevel=info"
    - "-Q"
    - "call-webhook-queue-v2"