# Infisical platform (Phase 1) — chart: infisical-standalone 1.9.0 (Infisical v0.158.0)
# Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here — they live
# in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
# Postgres/Redis passwords below guard ClusterIP-only services in the isolated infisical
# namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
infisical:
  enabled: true
  replicaCount: 1
  kubeSecretRef: infisical-secrets
  autoBootstrap:
    enabled: false
  image:
    tag: "v0.158.0"
    pullPolicy: IfNotPresent
  resources:
    limits:
      memory: 1000Mi
    requests:
      cpu: 350m

ingress:
  enabled: true
  nginx:
    enabled: false
  ingressClassName: traefik
  hostName: infisical.chemavx.xyz
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  tls:
    - secretName: infisical-tls
      hosts:
        - infisical.chemavx.xyz

postgresql:
  enabled: true
  name: postgresql
  fullnameOverride: postgresql
  auth:
    username: infisical
    password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
    database: infisicalDB
  primary:
    persistence:
      enabled: true
      storageClass: local-path
      size: 8Gi

redis:
  enabled: true
  name: redis
  fullnameOverride: redis
  architecture: standalone
  usePassword: true
  auth:
    password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"