# Non-secret configuration shared by every service. Keys mirror the
# ENKLY_* env vars from docker-compose.yml / .env.example 1:1 so the
# application code needs zero changes — only the hostnames change,
# from docker-compose service names to in-cluster Kubernetes Service
# names (which are identical, so most values don't even change).
# NOTE: the three *_POSTGRES_DSN values are NOT here — ConfigMap data
# is static text and cannot expand $(POSTGRES_PASSWORD); each DSN is
# instead composed inline in its Deployment's env: list (see the
# per-service files), where Kubernetes does support that expansion.
apiVersion: v1
kind: ConfigMap
metadata:
  name: enkly-config
  namespace: enkly
data:
  # --- shared ---
  ENKLY_BASE_URL: "https://ai.enkly.org"            # set to your real public URL / Ingress host
  # Back on vLLM (per your request), still on a GPU-less cluster: both
  # Deployments in 11-vllm.yaml now run vLLM's CPU backend — a custom
  # build with AVX-512 disabled (registry.enkly.org/enkly/vllm-cpu),
  # not vLLM's official pre-built image, after vllm-embed's init
  # container confirmed this cluster's nodes actually lack avx512f —
  # instead of the CUDA vllm/vllm-openai image, with no nvidia.com/gpu
  # request and no GPU-pool nodeSelector/toleration. See 11-vllm.yaml's
  # header for the build command and the memory-sizing fix that went
  # with it (vllm-chat's original 8Gi request exceeded this cluster's
  # confirmed ~7.76Gi per-node RAM outright).
  # Two Deployments, two Services, same as the original GPU manifest
  # (one vLLM engine process serves exactly one model — see
  # pkg/vllmkit's doc comment) — unlike the brief Ollama detour this
  # cluster also tried, which could multiplex both models behind one
  # daemon. Internal-only ClusterIP Services this time (no public
  # vllm-chat.enkly.org/vllm-embed.enkly.org Ingress) since agent and
  # knowledge are the only callers and both are in-cluster.
  ENKLY_VLLM_CHAT_URL: "http://vllm-chat:8000/v1"
  ENKLY_VLLM_EMBED_URL: "http://vllm-embed:8000/v1"
  # qwen3.5 (the original GPU deployment's model, ~35B-parameter MoE,
  # served via a GPTQ-Marlin checkpoint) isn't viable here twice over:
  # Marlin's INT4 kernels are CUDA-only, and 35B active-weight decode
  # at CPU speeds wouldn't be usable latency regardless. Went with
  # qwen2.5-1.5b-instruct rather than the 3B variant tried first —
  # unquantized bf16 (CPU quantized-GPTQ/AWQ kernel support exists but
  # is far less battle-tested than Marlin's GPU path, so plain bf16 is
  # the safer default here) — specifically because this cluster's
  # nodes only have ~7.76Gi RAM total each (see 11-vllm.yaml's header):
  # the 3B model's 8Gi request alone couldn't fit on any node, full
  # stop. 1.5B still supports OpenAI-style tool calling via vLLM's
  # hermes parser (required by
  # services/agent/internal/infrastructure/agentrun). See
  # 11-vllm.yaml's resources/VLLM_CPU_KVCACHE_SPACE for how this maps
  # to actual CPU/RAM, and its header for going back up to 3B or
  # higher once `kubectl describe node` confirms real free headroom.
  ENKLY_CHAT_MODEL: "qwen2.5-1.5b-instruct"
  # Note one real behavior gap versus the original Qwen3.5 GPU
  # deployment: Qwen2.5 has no equivalent to --reasoning-parser=qwen3's
  # separate "thinking" trace (Message.Thinking / wire
  # reasoning_content) — vLLM won't emit that field for this model, so
  # Thinking comes back empty. Doesn't break chat or tool calling,
  # just drops the reasoning-trace UI panel's content.
  #
  # Unchanged — nomic-embed-text was already the right size/cost
  # trade-off on CPU (see pkg/vllmkit's DefaultEmbedModel comment and
  # 11-vllm.yaml's vllm-embed Deployment), and no schema.sql
  # vector(768) dimension change is needed either.
  ENKLY_EMBED_MODEL: "nomic-embed-text"

  # --- iam ---
  ENKLY_IAM_GRPC_ADDR: ":9001"
  ENKLY_SMTP_HOST: "smtp.gmail.com"
  ENKLY_SMTP_PORT: "587"

  # --- billing ---
  ENKLY_BILLING_GRPC_ADDR: ":9002"

  # --- conversation ---
  ENKLY_CONVERSATION_GRPC_ADDR: ":9003"

  # --- workspace ---
  ENKLY_WORKSPACE_GRPC_ADDR: ":9004"
  ENKLY_WORKSPACE: "/data/workspace"
  ENKLY_BASH_TIMEOUT_SECONDS: "120"
  # Only tools actually present in the workspace image (see its
  # Dockerfile: ca-certificates + git). Extend the image before
  # widening this list.
  ENKLY_BASH_ALLOWLIST: "git,ls,cat,grep,find,pwd,echo"

  # --- knowledge ---
  ENKLY_KNOWLEDGE_GRPC_ADDR: ":9005"

  # --- agent ---
  ENKLY_AGENT_GRPC_ADDR: ":9006"

  # --- notification ---
  ENKLY_NOTIFICATION_HEALTH_ADDR: ":9007"
  ENKLY_SMTP_FROM: "noreply <contact.enkly@gmail.com>"

  # --- gateway ---
  ENKLY_GATEWAY_HTTP_ADDR: ":8080"
  ENKLY_TEMPLATES_DIR: "/app/web/templates"
  ENKLY_STATIC_DIR: "/app/web/static"

  # --- rabbitmq (non-secret half; the password half is in enkly-secrets) ---
  RABBITMQ_DEFAULT_USER: "enkly"