# AWS-specific values for Sim
# Example configuration for Amazon EKS deployment

# Global configuration
global:
  imageRegistry: "ghcr.io"
  storageClass: "gp3"

# Main application
app:
  enabled: true
  replicaCount: 2
  
  # Node selector for application pods (customize based on your EKS node labels)
  nodeSelector:
    kubernetes.io/arch: amd64
    node.kubernetes.io/instance-type: "t3.large"
  
  resources:
    limits:
      memory: "4Gi"
      cpu: "2000m"
    requests:
      memory: "2Gi"
      cpu: "1000m"
  
  # Production URLs (REQUIRED - update with your actual domain names)
  env:
    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
    BETTER_AUTH_URL: "https://simstudio.acme.com"
    SOCKET_SERVER_URL: "https://simstudio-ws.acme.com"
    NEXT_PUBLIC_SOCKET_URL: "https://simstudio-ws.acme.com"
    
    # Security settings (REQUIRED - replace with your own secure secrets)
    # Generate using: openssl rand -hex 32
    BETTER_AUTH_SECRET: "your-secure-production-auth-secret-here"
    ENCRYPTION_KEY: "your-secure-production-encryption-key-here"
    INTERNAL_API_SECRET: "your-secure-production-internal-api-secret-here"
    CRON_SECRET: "your-secure-production-cron-secret-here"

    # Optional: API Key Encryption (RECOMMENDED for production)
    # Generate 64-character hex string using: openssl rand -hex 32
    API_ENCRYPTION_KEY: "your-64-char-hex-api-encryption-key-here"  # Optional but recommended
    
    NODE_ENV: "production"
    NEXT_TELEMETRY_DISABLED: "1"
    
    # AWS-specific environment variables
    AWS_REGION: "us-west-2"

# Realtime service
realtime:
  enabled: true
  replicaCount: 2
  
  # Node selector for realtime pods (customize based on your EKS node labels)
  nodeSelector:
    kubernetes.io/arch: amd64
    node.kubernetes.io/instance-type: "t3.medium"
  
  resources:
    limits:
      memory: "4Gi"
      cpu: "1000m"
    requests:
      memory: "2Gi"
      cpu: "500m"
  
  env:
    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
    BETTER_AUTH_URL: "https://simstudio.acme.com"
    NEXT_PUBLIC_SOCKET_URL: "https://simstudio-ws.acme.com"
    BETTER_AUTH_SECRET: "your-secure-production-auth-secret-here"
    ALLOWED_ORIGINS: "https://simstudio.acme.com"
    NODE_ENV: "production"

# Database migrations
migrations:
  enabled: true
  
  resources:
    limits:
      memory: "2Gi"
      cpu: "1000m"
    requests:
      memory: "1Gi"
      cpu: "500m"

# PostgreSQL database
postgresql:
  enabled: true
  
  # Node selector for database pods (recommended: memory-optimized EC2 instances)
  nodeSelector:
    node.kubernetes.io/instance-type: "r5.large"
  
  # Database authentication (REQUIRED - set secure credentials)
  auth:
    username: postgres
    password: "your-secure-postgres-password"
    database: simstudio
  
  # Resource allocation optimized for AWS EKS
  resources:
    limits:
      memory: "4Gi"
      cpu: "2000m"
    requests:
      memory: "2Gi"
      cpu: "1000m"
  
  # Persistent storage using AWS EBS GP3 volumes
  persistence:
    enabled: true
    storageClass: "gp3"
    size: 50Gi
    accessModes:
      - ReadWriteOnce
  
  # SSL/TLS configuration
  tls:
    enabled: true
    certificatesSecret: postgres-tls-secret
  
  # PostgreSQL performance tuning for AWS infrastructure
  config:
    maxConnections: 1000
    sharedBuffers: "2GB"
    maxWalSize: "8GB"
    minWalSize: "160MB"

# Ollama AI models with GPU acceleration (AWS EC2 GPU instances)
ollama:
  enabled: true
  replicaCount: 1
  
  # GPU node targeting (recommended: g4dn.xlarge or p3.2xlarge instances)
  nodeSelector:
    node.kubernetes.io/instance-type: "g4dn.xlarge"
    kubernetes.io/arch: amd64
  
  tolerations:
    - key: "nvidia.com/gpu"
      operator: "Equal"
      value: "true"
      effect: "NoSchedule"
  
  # GPU resource allocation for AI model serving
  gpu:
    enabled: true
    count: 1
  
  resources:
    limits:
      memory: "16Gi"
      cpu: "4000m"
      nvidia.com/gpu: "1"
    requests:
      memory: "8Gi"
      cpu: "2000m"
  
  # High-performance storage for AI models
  persistence:
    enabled: true
    storageClass: "gp3"
    size: 100Gi
    accessModes:
      - ReadWriteOnce
  
  env:
    NVIDIA_DRIVER_CAPABILITIES: "all"
    OLLAMA_LOAD_TIMEOUT: "-1"
    OLLAMA_KEEP_ALIVE: "-1"
    OLLAMA_DEBUG: "1"

# Ingress using AWS Application Load Balancer (ALB)
ingress:
  enabled: true
  className: alb
  
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:us-west-2:123456789012:certificate/your-cert-arn"
  
  # Main application
  app:
    host: simstudio.acme.com
    paths:
      - path: /
        pathType: Prefix
  
  # Realtime service
  realtime:
    host: simstudio-ws.acme.com
    paths:
      - path: /
        pathType: Prefix
  
  # TLS configuration
  tls:
    enabled: true
    secretName: simstudio-tls-secret

# Pod disruption budget for high availability
podDisruptionBudget:
  enabled: true
  minAvailable: null
  maxUnavailable: 1  
  unhealthyPodEvictionPolicy: AlwaysAllow 
# Network policies
networkPolicy:
  enabled: true

# Pod anti-affinity for high availability across AWS Availability Zones
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values: ["simstudio"]
          topologyKey: kubernetes.io/hostname
      - weight: 50
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values: ["simstudio"]
          topologyKey: topology.kubernetes.io/zone

# Service Account with IAM roles for service account (IRSA) integration
serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: "arn:aws:iam::123456789012:role/SimStudioServiceRole"