apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: harbor
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://helm.goharbor.io
    chart: harbor
    targetRevision: 1.16.1
    helm:
      valuesObject:
        expose:
          type: ingress
          tls:
            enabled: true
            certSource: secret
            secret:
              secretName: harbor-tls
          ingress:
            hosts:
              core: harbor.basicstack.de
            className: traefik
            annotations:
              cert-manager.io/cluster-issuer: letsencrypt-prod
              traefik.ingress.kubernetes.io/router.entrypoints: websecure
              traefik.ingress.kubernetes.io/router.tls: "true"
        externalURL: https://harbor.basicstack.de

        persistence:
          enabled: true
          resourcePolicy: keep
          persistentVolumeClaim:
            registry:
              storageClass: hcloud-volumes-encrypted
              size: 50Gi
            database:
              storageClass: hcloud-volumes-encrypted
              size: 10Gi
            redis:
              storageClass: hcloud-volumes-encrypted
              size: 5Gi
            trivy:
              storageClass: hcloud-volumes-encrypted
              size: 5Gi
            jobservice:
              jobLog:
                storageClass: hcloud-volumes-encrypted
                size: 5Gi

        # Use internal PostgreSQL and Redis
        database:
          type: internal
          internal:
            existingSecret: harbor-secrets

        redis:
          type: internal

        # Harbor admin credentials
        existingSecretAdminPassword: harbor-secrets
        existingSecretAdminPasswordKey: harborAdminPassword

        # Enable OIDC authentication
        authMode: oidc_auth
        oidc:
          name: PocketID
          endpoint: https://auth.basicstack.de
          clientId: harbor
          clientSecret: ""  # Will be loaded from secret
          groupsClaim: groups
          adminGroup: admins
          scope: openid,profile,email,groups
          autoOnboard: true
          userClaim: email
          verifyCert: true
        existingSecretOIDC: harbor-secrets
        existingSecretOIDCKey: oidc.clientSecret

        # Resource limits
        core:
          resources:
            requests:
              memory: 256Mi
              cpu: 100m
            limits:
              memory: 1Gi
              cpu: 1000m

        portal:
          resources:
            requests:
              memory: 128Mi
              cpu: 100m
            limits:
              memory: 256Mi
              cpu: 500m

        registry:
          registry:
            resources:
              requests:
                memory: 256Mi
                cpu: 100m
              limits:
                memory: 1Gi
                cpu: 1000m

        trivy:
          enabled: true
          resources:
            requests:
              memory: 512Mi
              cpu: 200m
            limits:
              memory: 2Gi
              cpu: 1000m

  destination:
    server: https://kubernetes.default.svc
    namespace: harbor

  syncPolicy:
    syncOptions:
    - CreateNamespace=true
    automated:
      prune: false
      selfHeal: true