apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: markdown-vault-mcp
  namespace: mcp
spec:
  interval: 30m
  chartRef:
    kind: OCIRepository
    name: markdown-vault-mcp
  values:
    controllers:
      app:
        containers:
          app:
            image:
              repository: ghcr.io/pvliesdonk/markdown-vault-mcp
              tag: latest
            env:
              MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
              MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
              MARKDOWN_VAULT_MCP_EMBEDDINGS_PATH: /data/state/embeddings
              MARKDOWN_VAULT_MCP_STATE_PATH: /data/state/state.json
              MARKDOWN_VAULT_MCP_READ_ONLY: "false"
              MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
              MARKDOWN_VAULT_MCP_OIDC_CONFIG_URL: "https://auth.aggtaa.com/.well-known/openid-configuration"
              MARKDOWN_VAULT_MCP_OIDC_CLIENT_ID: "markdown-vault-mcp"
              MARKDOWN_VAULT_MCP_OIDC_CLIENT_SECRET:
                valueFrom:
                  secretKeyRef:
                    name: markdown-vault-mcp-secrets
                    key: OIDC_CLIENT_SECRET
              MARKDOWN_VAULT_MCP_OIDC_JWT_SIGNING_KEY:
                valueFrom:
                  secretKeyRef:
                    name: markdown-vault-mcp-secrets
                    key: OIDC_JWT_SIGNING_KEY
              MARKDOWN_VAULT_MCP_BEARER_TOKEN:
                valueFrom:
                  secretKeyRef:
                    name: markdown-vault-mcp-secrets
                    key: BEARER_TOKEN
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true
            resources:
              requests:
                cpu: 100m
                memory: 256Mi
              limits:
                memory: 1Gi

    service:
      app:
        controller: app
        ports:
          http:
            port: 8000

    ingress:
      app:
        className: traefik
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: md-vault.mcp.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: markdown-vault-mcp-tls
            hosts:
              - md-vault.mcp.aggtaa.com

    persistence:
      vault:
        type: persistentVolumeClaim
        accessMode: ReadWriteMany
        size: 30Gi
        storageClass: longhorn
        retain: true
        globalMounts:
          - path: /vault
      state:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
        size: 2Gi
        storageClass: longhorn
        retain: true
        globalMounts:
          - path: /data/state