# ArgoCD Helm Values — Single Source of Truth
# Chart: https://github.com/argoproj/argo-helm

global:
  domain: argocd.riotpiao.com

# Server configuration
server:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    hosts:
      - argocd.riotpiao.com
    tls:
      - secretName: argocd-server-tls
        hosts:
          - argocd.riotpiao.com

  # Allow insecure mode (terminate TLS at ingress)
  extraArgs:
    - --insecure

  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 1Gi

# Repo server configuration
repoServer:
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 1Gi

  # SOPS plugin for encrypted secrets
  volumes:
    - name: sops-age
      secret:
        secretName: sops-age
        optional: true
  volumeMounts:
    - name: sops-age
      mountPath: /home/argocd/.config/sops/age
      readOnly: true

  # Environment for SOPS
  env:
    - name: SOPS_AGE_KEY_FILE
      value: /home/argocd/.config/sops/age/keys.txt

# Controller configuration
controller:
  resources:
    requests:
      cpu: 200m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 2Gi

# Application controller configuration
applicationSet:
  enabled: true

# Notifications (optional, for Slack/Discord alerts)
notifications:
  enabled: false

# Redis for caching
redis:
  enabled: true
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 256Mi

# Tolerations for control-plane
server:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

repoServer:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

controller:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

# ArgoCD projects
configs:
  # Default project allows all repos
  cm:
    admin.enabled: "true"
    application.instanceLabelKey: argocd.argoproj.io/instance
    
  params:
    server.insecure: true

# RBAC (allow admin full access)
configs:
  rbac:
    policy.default: role:readonly
    policy.csv: |
      g, admin, role:admin