global:
  imageRegistry: ""
  # List of image pull secrets to use for pulling images from private registries
  # This helps avoid rate limiting (429 errors) when pulling from Docker Hub
  # Example:
  # imagePullSecrets:
  #   - name: regcred
  #   - name: docker-hub-secret
  imagePullSecrets: []

  otelCollector:
    # Custom OTEL Collector configuration, merged on top of the collector's
    # built-in config (works in both OpAMP supervisor and standalone mode).
    # Provide the configuration as a multi-line YAML string. When set, it is
    # rendered into the `clickstack-otel-custom-config` ConfigMap, mounted at
    # /etc/otelcol-contrib/custom/custom.config.yaml, and the
    # CUSTOM_OTELCOL_CONFIG_FILE environment variable points the collector
    # to it. Changing the value automatically restarts the collector pods.
    #
    # NOTE: the OTel confmap merges maps leaf-by-leaf. To override a built-in
    # processor (e.g. memory_limiter), define a new one under a different name
    # and re-declare the pipeline `processors:` lists to reference it.
    #
    # Example:
    # customConfig: |
    #   receivers:
    #     hostmetrics:
    #       collection_interval: 5s
    #       scrapers:
    #         cpu:
    #         load:
    #         memory:
    #   service:
    #     pipelines:
    #       metrics/hostmetrics:
    #         receivers: [hostmetrics]
    #         processors: [memory_limiter, batch]
    #         exporters: [clickhouse]
    customConfig: ""

hyperdx:
  # Ports shared across Deployment, Service, ConfigMap, and Ingress
  ports:
    api: 8000
    app: 3000
    opamp: 4320

  # ── K8s ConfigMap (clickstack-config) ────────────────────
  # Shared non-sensitive environment variables. Used by HyperDX and OTEL collector via envFrom.
  # All values support Helm template expressions (rendered via tpl).
  # Override any entry with a plain string to point at an external service.
  config:
    APP_PORT: "3000"
    API_PORT: "8000"
    HYPERDX_API_PORT: "8000"
    HYPERDX_APP_PORT: "3000"
    HYPERDX_LOG_LEVEL: "info"
    OTEL_SERVICE_NAME: "hdx-oss-api"
    USAGE_STATS_ENABLED: "true"
    OPAMP_PORT: "4320"
    HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE: "default"
    CLICKHOUSE_USER: "otelcollector"
    RUN_SCHEDULED_TASKS_EXTERNALLY: "false"
    # Service endpoint defaults -- override to use external instances
    FRONTEND_URL: "http://localhost:3000"
    MONGO_URI: 'mongodb://hyperdx:{{ .Values.hyperdx.secrets.MONGODB_PASSWORD }}@{{ include "clickstack.mongodb.svc" . }}:27017/hyperdx?authSource=hyperdx'
    OTEL_EXPORTER_OTLP_ENDPOINT: 'http://{{ include "clickstack.otel.fullname" . }}:4318'
    CLICKHOUSE_ENDPOINT: 'tcp://{{ include "clickstack.clickhouse.svc" . }}:{{ .Values.clickhouse.nativePort }}?dial_timeout=10s'
    CLICKHOUSE_SERVER_ENDPOINT: '{{ include "clickstack.clickhouse.svc" . }}:{{ .Values.clickhouse.nativePort }}'
    CLICKHOUSE_PROMETHEUS_METRICS_ENDPOINT: '{{ include "clickstack.clickhouse.svc" . }}:{{ .Values.clickhouse.prometheus.port }}'
    OPAMP_SERVER_URL: 'http://{{ include "clickstack.hyperdx.fullname" . }}:{{ .Values.hyperdx.ports.opamp }}'

  # ── K8s Secret (clickstack-secret) ───────────────────────
  # Shared sensitive environment variables. Used by HyperDX and OTEL collector via envFrom.
  #
  # Advanced: set to null to skip Secret creation entirely. This is useful when
  # managing secrets externally via deployment.env valueFrom entries. Requires
  # mongodb, clickhouse, and otel-collector to all be disabled. Users must
  # provide all required environment variables through their own secret management.
  secrets:
    HYPERDX_API_KEY: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    CLICKHOUSE_PASSWORD: "otelcollectorpass"
    CLICKHOUSE_APP_PASSWORD: "hyperdx"
    MONGODB_PASSWORD: "hyperdx"

  # ── K8s Deployment ───────────────────────────────────────
  deployment:
    image:
      repository: docker.hyperdx.io/hyperdx/hyperdx
      tag:
      pullPolicy: IfNotPresent
    replicas: 1     # ignored when autoscaling.enabled is true (HPA manages replicas)
    resources: {}
    livenessProbe:
      enabled: true
      initialDelaySeconds: 10
      periodSeconds: 30
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      enabled: true
      initialDelaySeconds: 1
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    nodeSelector: {}
    tolerations: []
    topologySpreadConstraints: []
    priorityClassName: ""
    annotations: {}
    labels: {}
    env: []
    # Additional init containers to run before the HyperDX container starts.
    # Useful for fetching certificates, warming caches, or other startup tasks.
    initContainers: []
    # Additional volumes to attach to the pod.
    volumes: []
    # Additional volume mounts to apply to the HyperDX container.
    volumeMounts: []
    waitForMongodb:
      image: "busybox@sha256:1fcf5df59121b92d61e066df1788e8df0cc35623f5d62d9679a41e163b6a0cdb"
      pullPolicy: IfNotPresent
    # Default connections and sources (ENABLED BY DEFAULT)
    # Set to empty string to disable: defaultConnections: "" or defaultSources: ""
    # To use an existing secret, set useExistingConfigSecret: true
    useExistingConfigSecret: false
    existingConfigSecret: ""
    existingConfigConnectionsKey: "connections.json"
    existingConfigSourcesKey: "sources.json"
    defaultConnections: |
      [
        {
          "name": "Local ClickHouse",
          "host": "http://{{ include "clickstack.clickhouse.svc" . }}:8123",
          "port": 8123,
          "username": "app",
          "password": "{{ .Values.hyperdx.secrets.CLICKHOUSE_APP_PASSWORD }}"
        }
      ]
    defaultSources: |
      [
        {
          "from": {
            "databaseName": "default",
            "tableName": "otel_logs"
          },
          "kind": "log",
          "timestampValueExpression": "Timestamp",
          "name": "Logs",
          "displayedTimestampValueExpression": "Timestamp",
          "implicitColumnExpression": "Body",
          "serviceNameExpression": "ServiceName",
          "bodyExpression": "Body",
          "eventAttributesExpression": "LogAttributes",
          "resourceAttributesExpression": "ResourceAttributes",
          "defaultTableSelectExpression": "Timestamp,ServiceName,SeverityText,Body",
          "severityTextExpression": "SeverityText",
          "traceIdExpression": "TraceId",
          "spanIdExpression": "SpanId",
          "connection": "Local ClickHouse",
          "traceSourceId": "Traces",
          "sessionSourceId": "Sessions",
          "metricSourceId": "Metrics"
        },
        {
          "from": {
            "databaseName": "default",
            "tableName": "otel_traces"
          },
          "kind": "trace",
          "timestampValueExpression": "Timestamp",
          "name": "Traces",
          "displayedTimestampValueExpression": "Timestamp",
          "implicitColumnExpression": "SpanName",
          "serviceNameExpression": "ServiceName",
          "bodyExpression": "SpanName",
          "eventAttributesExpression": "SpanAttributes",
          "resourceAttributesExpression": "ResourceAttributes",
          "defaultTableSelectExpression": "Timestamp,ServiceName,StatusCode,round(Duration/1e6),SpanName",
          "traceIdExpression": "TraceId",
          "spanIdExpression": "SpanId",
          "durationExpression": "Duration",
          "durationPrecision": 9,
          "parentSpanIdExpression": "ParentSpanId",
          "spanNameExpression": "SpanName",
          "spanKindExpression": "SpanKind",
          "statusCodeExpression": "StatusCode",
          "statusMessageExpression": "StatusMessage",
          "connection": "Local ClickHouse",
          "logSourceId": "Logs",
          "sessionSourceId": "Sessions",
          "metricSourceId": "Metrics"
        },
        {
          "from": {
            "databaseName": "default",
            "tableName": ""
          },
          "kind": "metric",
          "timestampValueExpression": "TimeUnix",
          "name": "Metrics",
          "resourceAttributesExpression": "ResourceAttributes",
          "metricTables": {
            "gauge": "otel_metrics_gauge",
            "histogram": "otel_metrics_histogram",
            "sum": "otel_metrics_sum",
            "_id": "682586a8b1f81924e628e808",
            "id": "682586a8b1f81924e628e808"
          },
          "connection": "Local ClickHouse",
          "logSourceId": "Logs",
          "traceSourceId": "Traces",
          "sessionSourceId": "Sessions"
        },
        {
          "from": {
            "databaseName": "default",
            "tableName": "hyperdx_sessions"
          },
          "kind": "session",
          "timestampValueExpression": "TimestampTime",
          "name": "Sessions",
          "displayedTimestampValueExpression": "Timestamp",
          "implicitColumnExpression": "Body",
          "serviceNameExpression": "ServiceName",
          "bodyExpression": "Body",
          "eventAttributesExpression": "LogAttributes",
          "resourceAttributesExpression": "ResourceAttributes",
          "defaultTableSelectExpression": "Timestamp,ServiceName,SeverityText,Body",
          "severityTextExpression": "SeverityText",
          "traceIdExpression": "TraceId",
          "spanIdExpression": "SpanId",
          "connection": "Local ClickHouse",
          "logSourceId": "Logs",
          "traceSourceId": "Traces",
          "metricSourceId": "Metrics"
        }
      ]

  # ── K8s Service ──────────────────────────────────────────
  service:
    type: ClusterIP
    annotations: {}
    # Expose the API port (8000) on the Service. Useful when deploying the
    # API-only image or when external traffic needs to reach port 8000 directly.
    apiPort:
      enabled: false

  # ── K8s Ingress ──────────────────────────────────────────
  # The primary ingress uses a passthrough pattern: annotations and spec are
  # rendered verbatim so any ingress controller (nginx, ALB, Traefik, etc.)
  # can be configured via values alone.
  # additionalIngresses is kept as a power feature for multi-ingress setups.
  ingress:
    enabled: false
    annotations: {}
    spec: {}
    additionalIngresses: []

  # ── K8s PodDisruptionBudget ──────────────────────────────
  podDisruptionBudget:
    enabled: false

  # ── K8s HorizontalPodAutoscaler ─────────────────────────
  # When enabled, the Deployment's replicas field is omitted (HPA manages it).
  # The spec is passed through verbatim -- provide any valid autoscaling/v2
  # HPA spec fields (minReplicas, maxReplicas, metrics, behavior, etc.).
  # NOTE: Do not include scaleTargetRef in spec. The chart auto-wires it to the
  # HyperDX Deployment. If scaleTargetRef is present, the template will fail.
  # IMPORTANT: If you later disable autoscaling, the Deployment will revert to
  # deployment.replicas (default 1). Set deployment.replicas to your desired
  # baseline before disabling autoscaling, or use minReplicas in the HPA spec
  # as your effective minimum.
  autoscaling:
    enabled: false
    spec: {}

  # ── K8s NetworkPolicy ───────────────────────────────────
  # The spec is passed through verbatim -- provide any valid NetworkPolicy spec
  # (podSelector, policyTypes, egress, ingress rules, etc.).
  networkPolicy:
    enabled: false
    spec: {}

  # ── K8s ServiceAccount ──────────────────────────────────
  # When create is true, a ServiceAccount is created and referenced by the Deployment.
  # When create is false but name is set, the Deployment references an existing SA.
  # Use annotations for provider-specific bindings (e.g., eks.amazonaws.com/role-arn).
  serviceAccount:
    create: false
    name: ""            # if empty and create is true, uses the chart fullname
    annotations: {}

  # ── K8s CronJob ──────────────────────────────────────────
  tasks:
    enabled: false
    checkAlerts:
      schedule: "*/1 * * * *"
      additionalArgs: {}
      resources:
        limits:
          cpu: 200m
          memory: 256Mi
        requests:
          cpu: 100m
          memory: 128Mi

mongodb:
  enabled: true
  # Full MongoDBCommunity CRD spec -- rendered verbatim into the CR.
  # See https://github.com/mongodb/mongodb-kubernetes/tree/master/docs/mongodbcommunity
  # for all available fields. Add persistence, nodeSelector, tolerations, etc. here.
  spec:
    members: 1
    type: ReplicaSet
    version: "5.0.32"
    security:
      authentication:
        modes: ["SCRAM"]
    users:
      - name: hyperdx
        db: hyperdx
        passwordSecretRef:
          name: '{{ include "clickstack.mongodb.fullname" . }}-password'
        roles:
          - name: dbOwner
            db: hyperdx
          - name: clusterMonitor
            db: admin
        scramCredentialsSecretName: '{{ include "clickstack.mongodb.fullname" . }}-scram'
    additionalMongodConfig:
      storage.wiredTiger.engineConfig.journalCompressor: zlib

clickhouse:
  enabled: true
  # Ports used for cross-service wiring (defaultConnections)
  port: 8123
  nativePort: 9000
  prometheus:
    enabled: true
    port: 9363
  # Full KeeperCluster CRD spec -- rendered verbatim into the CR.
  # See https://clickhouse.com/docs/clickhouse-operator/guides/introduction
  keeper:
    spec:
      replicas: 1
      dataVolumeClaimSpec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 5Gi
  # Full ClickHouseCluster CRD spec -- rendered verbatim into the CR.
  # See https://clickhouse.com/docs/clickhouse-operator/guides/configuration
  cluster:
    spec:
      containerTemplate:
        image:
          repository: clickhouse/clickhouse-server
          tag: "25.7-alpine"
        resources:
          requests:
            cpu: 500m
            memory: 2Gi
          limits:
            memory: 2Gi
      replicas: 1
      shards: 1
      keeperClusterRef:
        name: '{{ include "clickstack.clickhouse.keeper" . }}'
      dataVolumeClaimSpec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
      settings:
        extraUsersConfig:
          users:
            app:
              password: '{{ .Values.hyperdx.secrets.CLICKHOUSE_APP_PASSWORD }}'
              profile: default
              grants:
                - query: "GRANT SHOW ON *.*, SELECT ON system.*, SELECT ON default.*"
            otelcollector:
              password: '{{ .Values.hyperdx.secrets.CLICKHOUSE_PASSWORD }}'
              profile: default
              grants:
                - query: "GRANT SELECT,INSERT,CREATE,SHOW ON default.*"
        extraConfig:
          max_connections: 4096
          keep_alive_timeout: 64
          max_concurrent_queries: 100

# Additional Kubernetes manifests to deploy alongside the chart.
# Each entry is a complete Kubernetes object. Values are rendered through
# Helm's tpl function so template expressions (Release.Name, include, .Values)
# are available inside string fields.
# See docs/ADDITIONAL-MANIFESTS.md for full examples.
additionalManifests: []

# OpenTelemetry Collector subchart configuration (alias: otel-collector)
# See https://github.com/open-telemetry/opentelemetry-helm-charts for all options
# Set otel-collector.enabled to false to disable the OTEL collector entirely.
otel-collector:
  enabled: true
  mode: deployment
  image:
    repository: docker.clickhouse.com/clickhouse/clickstack-otel-collector
    tag: "2.30.1"
  extraEnvsFrom:
    - configMapRef:
        name: clickstack-config
    - secretRef:
        name: clickstack-secret
  # Roll collector pods when global.otelCollector.customConfig changes.
  # Merges with any user-provided podAnnotations.
  podAnnotations:
    checksum/custom-config: '{{ .Values.global.otelCollector.customConfig | default "" | sha256sum }}'
  # Mount for the optional custom config ConfigMap rendered from
  # global.otelCollector.customConfig. The volume is marked optional so it is
  # a no-op when no custom config is set.
  # NOTE: if you override extraVolumes/extraVolumeMounts yourself, Helm
  # replaces these lists entirely -- re-include the entries below to keep
  # global.otelCollector.customConfig working.
  extraVolumes:
    - name: custom-config
      configMap:
        name: clickstack-otel-custom-config
        optional: true
  extraVolumeMounts:
    - name: custom-config
      mountPath: /etc/otelcol-contrib/custom
      readOnly: true
  ports:
    otlp:
      enabled: true
      containerPort: 4317
      servicePort: 4317
      protocol: TCP
      appProtocol: grpc
    otlp-http:
      enabled: true
      containerPort: 4318
      servicePort: 4318
      protocol: TCP
    health-check:
      enabled: true
      containerPort: 13133
      servicePort: 13133
      protocol: TCP
    fluentd:
      enabled: true
      containerPort: 24225
      servicePort: 24225
      protocol: TCP
    metrics:
      enabled: true
      containerPort: 8888
      servicePort: 8888
      protocol: TCP
    jaeger-compact:
      enabled: false
    jaeger-thrift:
      enabled: false
    jaeger-grpc:
      enabled: false
    zipkin:
      enabled: false