env:
  # These are required for your environment to function correctly, and for us to push feature flags to you
  environment: on_prem
  onPremCustomerName: <the `customerName` from your license file>

  # Providing "false" here will prevent your instance of Opal from exporting error logs
  enableRemoteLogging: "false"

  # Set the authIssuer based on the OIDC provider you created.
  authIssuer: <OIDC Auth Issuer>
  # Leave the authProvider as this value
  authProvider: GENERIC_OIDC

  # Fill these in appropriately for the db instance you setup
  postgresUser: postgres
  postgresPassword: <postgres db password>
  postgresDb: opal
  postgresHost: <postgres host>
  postgresSslMode: "require"
  postgresPort: 5432

  # Generate secret values for these, and save them somewhere secure.
  authTokenEncryptionKey: <a random, secure string>
  csrfAuthenticationKey: <a random, secure string>
  databaseEncryptionKey:  <a random, secure string>
  opalApiEncryptionKey:  <a random, secure string>
  secureCookieHashkey: <a random, secure string>
  # You may alternatively point to an existing secret for these, like so:
  # authTokenEncryptionKey:
  #   secretKeyRef:
  #     name: "mySecretName"
  #     key: "authTokenEncryptionKey"

  redisHost: opal-web-redis-master
  redisPort: 6379

  # A DNS name you own that you will use to access Opal.
  hostname: <hostname for accessing opal>

  # Optional. Set this to have pods use an existing service account in your cluster. Otherwise, omit this.
  serviceAccount: <existing service account name>

  # This configures an SMTP provider for your instance of Opal to use for sending email notifications
  # If set to false, Opal would use its default external service for sending emails
  smtpEnable: true
  smtpServer: <smtp server>
  smtpPort: <smtp port>
  # Set smtpEncryptionEnabled to true to enable SMTP encryption. serverPort 465 uses SMTPS and serverPort 587 uses STARTTLS
  smtpEncryptionEnabled: false

# Optional. Enables async data exports backed by an S3-compatible bucket. Omit this block entirely to leave the feature off.
# In an airgapped environment, point this at an in-cluster store such as MinIO — cross-account AWS S3 is not reachable.
# See https://docs.opal.dev/docs/configure-async-exports-storage for setup details.
exportStorage:
  bucketName: <bucket name>
  endpoint: <https url to your s3-compatible endpoint>
  accessKey: <access key id>
  secretKey: <secret access key>

# This is what tells Opal to run as an Airgapped instance
fullAirGap:
  enabled: true
  # Use the Client ID and Client Secret of the *main* OIDC provider you created - not the one customized for the CLI.
  authClientID: <client id>
  authClientSecret: <client secret>
  # This is a human-readable name you can provide as a label for your auth provider
  # When signing in, your users will see a button that reads "Signin with <authProviderName>"
  authProviderName: <auth provider name>

# The private image repository you setup for Opal images
image:
  repository: <image repo url>

# Set these `registry` values to the same as `image.repository` above
redis:
  image:
    registry: <image repo url>
redis-sentinel-event-streaming:
  image:
    registry: <image repo url>
  sentinel:
    image:
      registry: <image repo url>

# Setting `enabled` to true will deploy an Ingress resource you can use to route traffic to Opal
# If you disable this, you will need to create your own ingress that routes traffic to the `opal-web` service
ingress:
  enabled: true
  # Always leave `override=true`
  override: true
  overrideAnnotations: # Here, you should fill in annotations that will link your ingress to a load balancer in your cloud provider
    # For AWS, this will look something like:
    # kubernetes.io/ingress.class: alb
    # alb.ingress.kubernetes.io/scheme: internet-facing
    # alb.ingress.kubernetes.io/certificate-arn: <ACM certificate ARN>

    # For GCP, this will look something like
    # ingress.gcp.kubernetes.io/pre-shared-cert: opal-certificate
    # kubernetes.io/ingress.global-static-ip-name: opal

# This controls RelayProxy, our replacement service for LaunchDarkly that provides feature flags to your cluster
ld-relay:
  image:
    # You may also set a `tag` attribute here if you need to override the version of the proxy to run
    # Otherwise, it'll default to the same version as your application
    repository: <image repo url>/opal-ld-relay-proxy

# Providing "false" here will prevent your instance of Opal from exporting application logs
log-forwarder:
  enabled: false