stack.basicstack.de/apps/harbor/values.yaml

harbor:
  expose:
    type: ingress
    tls:
      enabled: true
      certSource: secret
      secret:
        secretName: harbor-tls
    ingress:
      hosts:
        core: harbor.basicstack.de
      className: traefik
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod
        traefik.ingress.kubernetes.io/router.entrypoints: websecure
        traefik.ingress.kubernetes.io/router.tls: "true"

  externalURL: https://harbor.basicstack.de

  # Hetzner Cloud Volumes are ReadWriteOnce; RollingUpdate deadlocks on
  # jobservice/registry rollouts because the new pod cannot attach the PVC
  # while the old pod still holds it on another node (DEV-458).
  updateStrategy:
    type: Recreate

  persistence:
    enabled: true
    resourcePolicy: keep
    persistentVolumeClaim:
      registry:
        storageClass: hcloud-volumes-encrypted
        size: 50Gi
      database:
        storageClass: hcloud-volumes-encrypted
        size: 10Gi
      redis:
        storageClass: hcloud-volumes-encrypted
        size: 5Gi
      trivy:
        storageClass: hcloud-volumes-encrypted
        size: 5Gi
      jobservice:
        jobLog:
          storageClass: hcloud-volumes-encrypted
          size: 5Gi

  # Use internal PostgreSQL and Redis
  database:
    type: internal
    internal:
      existingSecret: harbor-secrets
      # Fix PostgreSQL data directory permissions
      # The init container needs to set correct ownership for PostgreSQL
      initContainer:
        migrator: {}
        permissions:
          image:
            registry: docker.io
            repository: library/busybox
            tag: latest
      # Set proper security context for PostgreSQL
      securityContext:
        runAsUser: 999
        fsGroup: 999
        fsGroupChangePolicy: "OnRootMismatch"

  redis:
    type: internal

  # Harbor admin credentials
  existingSecretAdminPassword: harbor-secrets
  existingSecretAdminPasswordKey: harborAdminPassword

  # OIDC authentication via Pocket ID
  # Note: Harbor requires database_auth to be configured first, then OIDC can be added via UI
  # See: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/

  # Resource limits
  core:
    resources:
      requests:
        memory: 256Mi
        cpu: 100m
      limits:
        memory: 1Gi
        cpu: 1000m

  portal:
    resources:
      requests:
        memory: 128Mi
        cpu: 100m
      limits:
        memory: 256Mi
        cpu: 500m

  registry:
    # Skip Kopia fs-backup of the registry blob PVC (DEV-573 safety net).
    podAnnotations:
      backup.velero.io/backup-volumes-excludes: registry-data
    registry:
      resources:
        requests:
          memory: 256Mi
          cpu: 100m
        limits:
          memory: 1Gi
          cpu: 1000m

  trivy:
    enabled: true
    # Skip Kopia fs-backup of the trivy scan cache PVC (DEV-573 safety net).
    podAnnotations:
      backup.velero.io/backup-volumes-excludes: data
    resources:
      requests:
        memory: 512Mi
        cpu: 200m
      limits:
        memory: 2Gi
        cpu: 1000m