apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: infcloud
  namespace: pim
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: infcloud
  driftDetection:
    mode: enabled
  values:
    controllers:
      infcloud:
        containers:
          app:
            image:
              repository: waja/infcloud
              tag: "0.13.1-16"
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true

    service:
      app:
        controller: infcloud
        ports:
          http:
            port: 80

    ingress:
      app:
        className: traefik
        # this ingress owns the cert-manager request for c.aggtaa.com
        # (secret kept as "radicale-tls" post-migration so the existing,
        # already-valid cert is reused instead of re-issued). davical's
        # ingress just references the same secret without its own
        # annotation - a second annotated Ingress would create a
        # competing Certificate for the same host/secret.
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: c.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: radicale-tls
            hosts:
              - c.aggtaa.com

    persistence:
      config:
        type: configMap
        name: infcloud-config
        globalMounts:
          - path: /srv/infcloud/config/config.js
            subPath: config.js
            readOnly: true