values.yaml

# Default values for zero-cache helm chart
# For more details, see: https://zero.rocicorp.dev/docs/deployment

## Common Configuration
image:
  # Official Zero image from Rocicorp
  repository: docker.io/rocicorp/zero
  # Will default to the appVersion from Chart.yaml if not overridden
  tag: ""
  pullPolicy: IfNotPresent

# Image pull secrets for private container registries
imagePullSecrets: []
# - name: regcred

# Common environment variables shared between components
common:
  # Application identifier
  appId: zero
  # If specified, will create publications for tables in these schemas
  appPublications: []
  # Required: Path to the SQLite replica file
  replicaFile: /data/sync-replica.db
  # Automatically reset and resync when replication is halted
  autoReset: true
  # Auth configuration (one of secret, jwk, or jwksUrl MUST be provided)
  auth:
    # Secret for JWT authentication using symmetric keys
    secret:
      {}
      # Direct value for the secret
      # value: "your-jwt-secret-key"
      # Or, reference a value from a configMap, secret, etc.
      # valueFrom:
      #   secretKeyRef:
      #     name: my-auth-secret
      #     key: jwt-secret
      #     optional: false
      #   # or configMapKeyRef, fieldRef, resourceFieldRef

    # Public key in JWK format for asymmetric JWT verification
    jwk:
      {}
      # Direct value for the JWK
      # value: '{"kty":"RSA","e":"AQAB","kid":"your-key-id","n":"your-public-key-data"}'
      # Or, reference a value from a configMap, secret, etc.
      # valueFrom:
      #   secretKeyRef:
      #     name: my-auth-jwk
      #     key: public-key
      #     optional: false
      #   # or configMapKeyRef, fieldRef, resourceFieldRef
    # URL that returns a JWK set (often provided by auth services like Auth0, Cognito)
    jwksUrl:
      {}
      # Direct value for the JWKS URL
      # value: "https://your-auth-domain.auth0.com/.well-known/jwks.json"
      # Or, reference a value from a configMap, secret, etc.
      # valueFrom:
      #   configMapKeyRef:
      #     name: my-auth-config
      #     key: jwks-url
      #     optional: false
      #   # or secretKeyRef, fieldRef, resourceFieldRef

  # Admin password for management endpoints (inspector/statz)
  adminPassword: {}
    # Direct value for the admin password
    # value: "your-admin-password"
    # Or, reference a value from a configMap, secret, etc.
    # valueFrom:
    #   secretKeyRef:
    #     name: my-admin-secret
    #     key: admin-password
    #     optional: false
    #   # or configMapKeyRef, fieldRef, resourceFieldRef

  # Database configuration
  database:
    # Upstream database connection configuration
    upstream:
      # Database connection string (PostgreSQL URL format)
      url:
        {}
        # Direct value for the connection string
        # value: "postgres://app_user:password123@postgres-primary.default.svc.cluster.local:5432/app_db"
        # Or, reference a value from a configMap, secret, etc.
        # valueFrom:
        #   secretKeyRef:
        #     name: postgres-credentials
        #     key: upstream-url
        #     optional: false
      # Max connections to upstream database
      maxConns: 20

    # CVR database connection configuration
    cvr:
      # Database connection string (PostgreSQL URL format)
      url:
        {}
        # Direct value for the connection string
        # value: "postgres://cvr_user:password123@postgres-cvr.default.svc.cluster.local:5432/cvr_db"
        # Or, reference a value from a configMap, secret, etc.
        # valueFrom:
        #   secretKeyRef:
        #     name: postgres-credentials
        #     key: cvr-url
        #     optional: false
      # Max connections to CVR database
      maxConns: 30
      # CVR garbage collection
      garbageCollection:
        # Hours of inactivity before CVR eligible for purging
        inactivityThresholdHours: 48
        # CVRs purged per GC interval (0 = disabled)
        initialBatchSize: 25
        # Initial interval in seconds between GC checks
        initialIntervalSeconds: 60

    # Change database connection configuration
    change:
      # Database connection string (PostgreSQL URL format)
      url:
        {}
        # Direct value for the connection string
        # value: "postgres://change_user:password123@postgres-change.default.svc.cluster.local:5432/change_db"
        # Or, reference a value from a configMap, secret, etc.
        # valueFrom:
        #   secretKeyRef:
        #     name: postgres-credentials
        #     key: change-url
        #     optional: false
      # Max connections to change database
      maxConns: 5

  # Litestream configuration for SQLite replication
  litestream:
    # S3-compatible backup URL (e.g., s3://bucket-name/backup)
    backupUrl: ""
    # Size threshold for checkpointing (MB)
    checkpointThresholdMb: 40
    # Interval between incremental backups (minutes)
    incrementalBackupIntervalMinutes: 15
    # Interval between snapshot backups (hours)
    snapshotBackupIntervalHours: 12
    # Parallelism for restore operations
    restoreParallelism: 48
    # Log level for litestream
    logLevel: warn
    # Parallel parts for snapshot upload/download
    multipartConcurrency: 48
    # Size of each multipart chunk in bytes (default 16 MiB)
    multipartSize: 16777216

  # Performance tuning
  performance:
    # Interval for SQLite VACUUM operation (hours, unset = no vacuum)
    replicaVacuumIntervalHours: null
    # Workers for table copying during initial sync
    initialSyncTableCopyWorkers: 5

  # Logging configuration
  logging:
    # Log format: text or json
    format: text
    # Log level: debug, info, warn, error
    level: info
    # Slow query thresholds
    slowHydrateThreshold: 100
    slowRowThreshold: 2
    # IVM sampling rate (1 in N requests)
    ivmSampling: 5000
    # OpenTelemetry traces
    otel:
      enable: false
      endpoint: ""
      headers: ""
      resourceAttributes: ""
      nodeResourceDetectors: ""

  # Rate limiting
  rateLimiting:
    # Maximum mutations per user
    perUserMutationLimitMax: null
    # Window for mutation rate limiting (ms)
    perUserMutationLimitWindowMs: 60000

  # API server endpoints (custom queries and mutators)
  # See: https://zero.rocicorp.dev/docs/custom-mutators
  api:
    # URL for mutation handler (ZERO_MUTATE_URL >=0.24, ZERO_PUSH_URL <0.24)
    mutateUrl: ""
    # URL for query handler (>=0.24 only)
    queryUrl: ""
    # API key for authorizing zero-cache to call mutation handler
    mutateApiKey: {}
      # value: "your-api-key"
      # valueFrom:
      #   secretKeyRef:
      #     name: my-api-key
      #     key: mutate-key
    # API key for authorizing zero-cache to call query handler
    queryApiKey: {}
      # value: "your-api-key"
      # valueFrom:
      #   secretKeyRef:
      #     name: my-api-key
      #     key: query-key
    # Forward cookies from client requests to mutation handler
    mutateForwardCookies: false
    # Forward cookies from client requests to query handler
    queryForwardCookies: false

  # Advanced configuration
  advanced:
    # Delay startup until first request (single-node only)
    lazyStartup: false
    # Anonymous telemetry (set false or DO_NOT_TRACK=1 to disable)
    enableTelemetry: true
    # Enable query planner for ZQL optimization
    enableQueryPlanner: true
    # Max ms a sync worker spends in IVM before yielding
    yieldThresholdMs: 10
    # SQLite page cache size in KiB (null = SQLite default ~2MB)
    replicaPageCacheSizeKib: null
    # Temp directory for IVM operator storage
    storageTmpDir: ""
    # WebSocket per-message deflate compression
    websocketCompression: false
    # WebSocket compression options (JSON string)
    websocketCompressionOptions: ""

## Single Node Configuration
## This is a simplified deployment option for development or small deployments
singleNode:
  # Enable single-node deployment (disables replicationManager and viewSyncer)
  enabled: false

  # Resource requests and limits
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 1
      memory: 2Gi

  # Persistent storage for SQLite replica
  persistence:
    enabled: true
    accessMode: ReadWriteOnce
    size: 10Gi
    storageClass: null
    annotations: {}
    allowVolumeExpansion: true
    retainPolicy: "Delete" # Options: Delete, Retain

  # Service configuration
  service:
    type: ClusterIP
    port: 4848
    annotations: {}

  # Pod annotations
  podAnnotations: {}

  # Node selector
  nodeSelector: {}

  # Tolerations
  tolerations: []

  # Affinity settings
  affinity: {}

  # Startup probe for slow-starting instances
  startupProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
    successThreshold: 1

## Replication Manager Configuration
replicationManager:
  # Resource requests and limits
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 1
      memory: 2Gi

  # Persistent storage for SQLite replica
  persistence:
    enabled: true
    accessMode: ReadWriteOnce
    size: 10Gi
    storageClass: null
    annotations: {}
    allowVolumeExpansion: true
    retainPolicy: "Delete" # Options: Delete, Retain

  # Service configuration
  service:
    type: ClusterIP
    port: 4849
    annotations: {}

  # Pod annotations
  podAnnotations: {}

  # Node selector
  nodeSelector: {}

  # Tolerations
  tolerations: []

  # Affinity settings
  affinity: {}

  # Startup probe for slow-starting instances
  startupProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
    successThreshold: 1

## View Syncer Configuration
viewSyncer:
  # Number of replicas (horizontally scalable)
  # Set this to at least 2 for high availability
  # Note: If autoscaling.enabled=true, this becomes the initial number of replicas
  replicas: 2

  # Resource requests and limits
  resources:
    requests:
      cpu: 1
      memory: 2Gi
    limits:
      cpu: 2
      memory: 4Gi

  # Autoscaling configuration
  autoscaling:
    # When enabled, replicas field becomes the initial/minimum replica count
    enabled: false
    # Minimum number of replicas for the HPA
    minReplicas: 2
    # Maximum number of replicas for the HPA
    maxReplicas: 10
    # Target CPU threshold for scaling
    targetCPUUtilizationPercentage: 80
    # Target memory threshold for scaling
    targetMemoryUtilizationPercentage: 80

  # Persistent storage for SQLite replica
  # Each view-syncer pod gets its own PVC via StatefulSet volumeClaimTemplates
  # If disabled, pods will use ephemeral storage and re-sync from S3 on restart (if configured)
  persistence:
    enabled: true
    accessMode: ReadWriteOnce
    size: 10Gi
    storageClass: null
    annotations: {}
    allowVolumeExpansion: true
    retainPolicy: "Delete" # Options: Delete, Retain

  # Service configuration
  service:
    type: ClusterIP
    # Default Zero port - align with zero-cache-config port setting
    port: 4848
    # Additional service annotations
    # Note: Client IP session affinity is automatically added for better performance
    annotations: {}

  # Create an Ingress resource
  ingress:
    enabled: false
    className: ""
    annotations: {}
    hosts:
      - host: zero-cache.local
        paths:
          - path: /
            pathType: Prefix
    tls: []

  # Pod annotations
  podAnnotations: {}

  # Node selector
  nodeSelector: {}

  # Tolerations
  tolerations: []

  # Affinity settings
  affinity: {}

  # Pod Disruption Budget
  pdb:
    enabled: true
    minAvailable: 1

  # Startup probe for slow-starting instances
  startupProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
    successThreshold: 1

## S3-compatible Storage Configuration
s3:
  # Enable S3 backup with Litestream (strongly recommended for production)
  enabled: false
  # Access credentials for S3
  accessKey:
    {}
    # Direct value for the access key
    # value: "AKIAIOSFODNN7EXAMPLE"
    # Or, reference a value from a configMap, secret, etc.
    # valueFrom:
    #   secretKeyRef:
    #     name: aws-s3-credentials
    #     key: access-key
    #     optional: false
    #   # or configMapKeyRef, fieldRef, resourceFieldRef
  secretKey:
    {}
    # Direct value for the secret key
    # value: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    # Or, reference a value from a configMap, secret, etc.
    # valueFrom:
    #   secretKeyRef:
    #     name: aws-s3-credentials
    #     key: secret-key
    #     optional: false
    #   # or configMapKeyRef, fieldRef, resourceFieldRef
  # Region setting for S3
  region: us-east-1
  # For S3-compatible storage providers (MinIO, DigitalOcean Spaces, etc.)
  # Leave empty for AWS S3
  endpoint: ""
  # Bucket configuration
  # Must be created before deployment
  bucketName: "zero-cache-backup"
  # Path within bucket for backups
  path: "backup"

## Security Context Configuration
# Security best practices for containers
securityContext:
  runAsUser: 1000
  runAsGroup: 1000
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

podSecurityContext:
  runAsNonRoot: true
  fsGroup: 1000
  fsGroupChangePolicy: OnRootMismatch
  seccompProfile:
    type: RuntimeDefault

## Service Account Configuration
serviceAccount:
  create: true
  annotations: {}
  name: ""
  automountServiceAccountToken: true