agent:
  replicaCount: 3
  env:
    WOODPECKER_MAX_WORKFLOWS: "8"
    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
    WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
    WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
    # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
    # serviceAccountName is gated behind this agent flag (default false).
    # The estate's pipelines set backend_options.kubernetes.serviceAccountName
    # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
    WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
    WOODPECKER_LOG_LEVEL: debug
  #extraSecretNamesForEnvFrom:
  #  - woodpecker-default-agent-secret
  persistence:
    storageClass: cephrbd-fast-delete
  podAnnotations:
    configmap.reloader.stakater.com/auto: "true"
  resources:
    requests:
      cpu: 50m
    limits:
      memory: 128Mi

server:
  statefulSet:
    replicaCount: 1
  env:
    WOODPECKER_HOST: 'https://ci.k8s.syd1.au.unkin.net'
    WOODPECKER_OPEN: "true"
    WOODPECKER_ADMIN: "unkinben"
    WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true"
    WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure"
  extraSecretNamesForEnvFrom:
    - woodpecker-gitea
    - woodpecker-postgres-credentials
    - woodpecker-database-config
  persistentVolume:
    storageClass: cephrbd-fast-delete
  podAnnotations:
    configmap.reloader.stakater.com/auto: "true"
  ingress:
    enabled: true
    annotations:
      cert-manager.io/cluster-issuer: vault-issuer
      cert-manager.io/common-name: ci.k8s.syd1.au.unkin.net
      cert-manager.io/private-key-size: "4096"
      external-dns.alpha.kubernetes.io/hostname: ci.k8s.syd1.au.unkin.net
      external-dns.alpha.kubernetes.io/target: 198.18.200.0
    ingressClassName: nginx
    hosts:
      - host: ci.k8s.syd1.au.unkin.net
        paths:
          - path: /
            backend:
              servicePort: 80
    tls:
      - hosts:
          - ci.k8s.syd1.au.unkin.net
        secretName: ci-tls
  resources:
    requests:
      cpu: 100m
    limits:
      memory: 128Mi