values.yaml

# Default values for nebari-nebi-pack
# This is a YAML-formatted file.

# =============================================================================
# Nebari Integration
# =============================================================================
# Creates a NebariApp CRD that configures routing and auth via nebari-operator.
# Set to false when deploying outside of Nebari.
nebariapp:
  enabled: true
  # hostname: nebi.example.com  # Required when enabled
  service:
    name: ""  # Defaults to {{ fullname }}
    port: 80
  routing:
    routes:
      - pathPrefix: /
    # /api and /docs bypass the gateway OIDC filter so bearer-token API calls
    # (e.g. the jhub-apps environment selector) reach nebi directly; nebi
    # validates the token itself.
    publicRoutes:
      - pathPrefix: /api/
        pathType: PathPrefix
      - pathPrefix: /docs/
        pathType: PathPrefix
  auth:
    enabled: true
    provider: keycloak
    provisionClient: true
    # redirectURI must match the Envoy Gateway SecurityPolicy callback path.
    # Nebi itself does NOT run an SSO proxy – auth is handled at the gateway
    # (enforceAtGateway: true, the operator default), so oauth2-proxy's
    # /oauth2/callback endpoint is what the IdP redirects back to.
    redirectURI: /oauth2/callback
    scopes:
      - openid
      - profile
      - email
      - groups
    tokenExchange:
      # Allow other NebariApp clients (e.g. JupyterHub) to exchange a user
      # token for a Nebi-audience token in Keycloak. Required by the jhub-apps
      # environment selector and Nebi auto-auth.
      enabled: true
  # landingPage controls whether and how this service appears on the Nebari landing page
  # portal (served by nebari-landing / nebari-webapi).
  landingPage:
    enabled: true
    displayName: "Nebi"
    description: "Manage and share Conda/Pip environments for your Nebari cluster"
    icon: "https://raw.githubusercontent.com/nebari-dev/nebi/main/docs/static/img/nebi-icon.png"
    category: "Platform"
    priority: 10
    # externalUrl: ""  # Override the URL shown on the card (defaults to hostname)
    healthCheck:
      enabled: true
      path: /api/v1/health
      intervalSeconds: 30
      timeoutSeconds: 5

# =============================================================================
# Nebi Application
# =============================================================================
image:
  repository: quay.io/nebari/nebi
  tag: sha-5ca877a
  pullPolicy: IfNotPresent

replicaCount: 1

# Deployment strategy – Recreate avoids Multi-Attach errors on RWO volumes
strategy:
  type: Recreate

# Auth configuration (env vars on the Deployment)
auth:
  # Keycloak/OIDC groups that grant Nebi admin role
  proxyAdminGroups: "admin,nebi-admin"
  # OIDC integration. Enabled by default so a stock Nebari install authenticates
  # against Keycloak with no extra values: issuerURL, clientID and
  # clientSecretName are all derived to match the client the nebari-operator
  # provisions for this NebariApp. Override any field to opt out of the
  # convention. nebi still runs NEBI_AUTH_TYPE=basic and validates the
  # gateway-forwarded OIDC token via the verifier wired in here.
  oidc:
    enabled: true
    # Derived from keycloak.hostname (which defaults to keycloak.<base domain of
    # nebariapp.hostname>) as https://<keycloak.hostname>/realms/nebari.
    issuerURL: ""
    # Optional: separate discovery URL for split-horizon deployments where the
    # public issuerURL is not reachable from in-cluster pods. Nebi fetches
    # .well-known/openid-configuration from this URL while still validating the
    # token "iss" against issuerURL. When empty, auto-derived from
    # keycloak.releaseName/namespace/realm to reach the in-cluster Keycloak
    # service (the codecentric/keycloakx convention used by nebari):
    #   http://<releaseName>-keycloakx-http.<namespace>.svc.cluster.local:8080/realms/<realm>
    # e.g.: http://keycloak-keycloakx-http.keycloak.svc.cluster.local:8080/realms/nebari
    discoveryURL: ""
    # Derived to match the operator-provisioned client when empty:
    #   clientID         = <release namespace>-<fullname>
    #   clientSecretName = <fullname>-oidc-client
    clientID: ""
    clientSecretName: ""

# Keycloak configuration used to derive OIDC URLs when not explicitly set.
# hostname derives issuerURL; serviceHost/realm derive discoveryURL.
keycloak:
  # Public hostname — derives issuerURL as https://<hostname>/realms/<realm>.
  # Defaults to keycloak.<base domain of nebariapp.hostname>.
  hostname: ""
  # In-cluster Keycloak service host (host:port) used to derive discoveryURL.
  # The codecentric/keycloakx chart names its Service <release>-keycloakx-http;
  # defaults to the canonical nebari deploy (release=keycloak, namespace=keycloak).
  serviceHost: "keycloak-keycloakx-http.keycloak.svc.cluster.local:8080"
  # Realm name; matches the standard Nebari operator setup.
  realm: "nebari"

# Server configuration
server:
  port: 8460
  mode: production

# Logging
log:
  format: json
  level: info

# Queue configuration (single pod = in-memory)
queue:
  type: memory

# Storage for workspace environments
persistence:
  enabled: true
  size: 20Gi
  accessMode: ReadWriteOnce
  storageClassName: ""  # Leave empty to use cluster default
  mountPath: /app/data/environments

# =============================================================================
# Branding
# =============================================================================
# Runtime branding for the Nebi web UI — title, logo, favicon and theme tokens
# applied at deploy time, with no image rebuild.
#
# How it works: when any field below is non-empty the chart renders a ConfigMap
# holding a `config.json`, mounts it at /etc/nebi/branding, and points nebi at
# it with NEBI_BRANDING_CONFIG_PATH. Nebi serves that file at /public/config.json
# in place of the copy baked into the image, and the SPA fetches it before it
# mounts (frontend/src/lib/brandingConfig.ts).
#
# When every field is empty (the default) nothing is rendered, no volume is
# mounted, no env var is set, and `helm template` output is byte-identical to
# prior versions of the chart — existing installs are unaffected.
#
# Requires an image containing the runtime-theming support (nebi >= the
# "Support Basic Runtime Theming" release; the pinned tag above has it).
branding:
  # Browser tab title. Empty uses the built-in "Nebi - Environment Management".
  title: ""
  # Logo shown in the UI header. Must be same-origin: a root-relative path
  # (e.g. /assets/acme-logo.svg) or a base64 data: URI of an image type
  # (png/jpeg/svg+xml/webp/gif/x-icon). External http(s) URLs are rejected by
  # the frontend. Empty uses the built-in Nebi logo, which already switches
  # between light and dark variants.
  logoUrl: ""
  # Optional dark-mode variant of the logo, same URL rules as logoUrl. Dark mode
  # resolves to logoUrlDark, falling back to logoUrl, then to the built-in dark
  # logo; light mode always uses logoUrl. Set only logoUrl to reuse one asset in
  # both schemes (the behaviour before this field existed).
  #
  # Needs nebi >= the release containing logoUrlDark support (nebari-dev/nebi
  # PR 516) - the pinned image tag above predates it. On an older image the key
  # is simply ignored and dark mode keeps using logoUrl, so setting it early is
  # harmless but has no effect until the image is bumped.
  logoUrlDark: ""
  # Favicon, same URL rules as logoUrl. Empty uses the built-in favicon.
  faviconUrl: ""
  # CSS custom-property overrides applied at runtime, per color scheme.
  # `light` is written to :root, `dark` to .dark.
  #
  # Keys are camelCase token names; they are kebab-cased and prefixed to form
  # the CSS variable (primaryHover -> --color-primary-hover). `radius` maps to
  # --radius. A key that already starts with `--` is passed through verbatim.
  #
  # Overridable tokens (from the frontend's index.css):
  #   background, foreground, card, cardForeground, popover, popoverForeground,
  #   primary, primaryForeground, primaryHover, navHover, secondary,
  #   secondaryForeground, muted, mutedForeground, accent, accentForeground,
  #   destructive, destructiveForeground, border, input, ring, radius
  #
  # Values are sanitized in the browser and dropped if they contain CSS
  # injection characters (; < > { } " ' \) or url(...) / expression(...) /
  # javascript:. Any CSS color notation without those characters works
  # (#rrggbb, rgb(...), hsl(...), oklch(...)). Note the quote restriction means
  # font-family stacks with quoted names cannot be set this way.
  #
  # Example:
  #   theme:
  #     light:
  #       primary: "#0f62fe"
  #       primaryHover: "#0043ce"
  #       primaryForeground: "#ffffff"
  #       radius: 0.25rem
  #     dark:
  #       primary: "#78a9ff"
  #       primaryHover: "#a6c8ff"
  theme:
    light: {}
    dark: {}

# =============================================================================
# TLS Trust
# =============================================================================
# Mount a ConfigMap containing additional CA certificates into the nebi pod,
# and set SSL_CERT_FILE to point at it. Required on clusters with a
# TLS-intercepting egress proxy whose CA is not in the container's default
# trust store — otherwise pixi/rattler outbound HTTPS to conda-forge / pypi /
# github fails with "unknown CA".
#
# Rust's rustls-native-certs (used by pixi/rattler) honors SSL_CERT_FILE but
# does NOT iterate /etc/ssl/certs/, so both the bind mount AND the env var
# are required — the env var is set automatically when this value is set.
#
# The named ConfigMap must already exist in the release namespace and must
# have a key `ca-bundle.crt` containing one or more PEM-encoded CA certs.
# When empty (default), no mount is added and `helm template` output is
# byte-identical to prior versions of the chart.
orgCABundle:
  configMapName: ""

# =============================================================================
# Embedded PostgreSQL
# =============================================================================
postgres:
  enabled: true
  image:
    repository: postgres
    tag: "16"
    pullPolicy: IfNotPresent
  storage:
    size: 10Gi
    storageClassName: ""  # Leave empty to use cluster default
  resources: {}

# =============================================================================
# Service
# =============================================================================
service:
  type: ClusterIP
  port: 80
  targetPort: 8460

# =============================================================================
# Resources
# =============================================================================
resources: {}
  # limits:
  #   cpu: 1000m
  #   memory: 1Gi
  # requests:
  #   cpu: 250m
  #   memory: 256Mi

# =============================================================================
# Service Account
# =============================================================================
serviceAccount:
  create: true
  name: ""
  annotations: {}

# =============================================================================
# Overrides
# =============================================================================
nameOverride: ""
fullnameOverride: ""