velero:
  # Pinned chart version 12.1.0 (Velero appVersion 1.18.1).
  # AWS plugin follows Velero minor version: v1.14.x for Velero 1.18.x.
  image:
    repository: velero/velero
    tag: v1.18.1
    pullPolicy: IfNotPresent

  # Bring the AWS object-storage plugin in as an initContainer that copies
  # the binary into /plugins so the Velero server can load it.
  initContainers:
    - name: velero-plugin-for-aws
      image: velero/velero-plugin-for-aws:v1.14.3
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - mountPath: /target
          name: plugins

  # Kopia file-system backup requires the node-agent daemonset on every
  # node whose PVC data we back up.
  deployNodeAgent: true

  # BackupStorageLocation credentials come from the SealedSecret
  # apps/velero/velero-s3-credentials-sealed.yaml (key: cloud, INI format
  # with aws_access_key_id / aws_secret_access_key for the dedicated
  # `velero-prod` Hetzner OS credential from DEV-570).
  credentials:
    useSecret: true
    existingSecret: velero-s3-credentials

  # Kopia backup-repository password (velero-repo-credentials Secret,
  # key `repository-password`) is auto-discovered by Velero — this is a
  # hard-coded constant in the Velero server (see pkg/repository/keys),
  # so no extra wiring is needed. SealedSecret lives at
  # apps/velero/velero-repo-credentials-sealed.yaml.

  # Turn OFF volume-snapshot CRDs — Hetzner Cloud Volumes have no CSI
  # snapshot support, so filesystem backup via Kopia is the only path.
  snapshotsEnabled: false
  backupsEnabled: true

  configuration:
    # Kopia uploader (unified repo). This is the Velero server default in
    # 1.18 but we set it explicitly so any future default change does not
    # silently rewrite our repos to restic.
    uploaderType: kopia

    # No CSI feature flag — see snapshotsEnabled comment above.
    features: ""

    backupStorageLocation:
      - name: default
        provider: aws
        bucket: basicstack-velero
        default: true
        credential:
          name: velero-s3-credentials
          key: cloud
        config:
          # Hetzner Object Storage in Helsinki (hel1). Region is used by
          # the AWS SDK signer; endpoint overrides the AWS endpoint URL.
          region: hel1
          s3ForcePathStyle: "false"
          s3Url: https://hel1.your-objectstorage.com
          # publicUrl left unset — this backend is not user-facing.

    # No volumeSnapshotLocation entries — snapshotsEnabled: false above
    # already suppresses the default snapshot location CRD.

  # Small resource footprint until we know real backup sizing (DEV-573).
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

  nodeAgent:
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 1000m
        memory: 1Gi

  metrics:
    enabled: true
    serviceMonitor:
      enabled: false

  # Do not install the bundled `velero` CLI kubectl image — we run the
  # CLI from cp-1.
  kubectl:
    image:
      repository: bitnami/kubectl
    resources: {}

  # No schedules here — those live in DEV-573.
  schedules: {}