controllers:
  main:
    type: deployment
    strategy: Recreate

    containers:
      main:
        image:
          repository: ghcr.io/c4illin/convertx
          tag: latest
          pullPolicy: IfNotPresent
        
        # RELAX RESOURCE LIMITS TO PREVENT THREAD STALLS
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: "6000m"   # Allow full core utilization during deep video transcodes
            memory: 4Gi    # Slightly higher ceiling for large video processing blocks

        env:
          PUID: "1000"
          PGID: "1000"
          JWT_SECRET: "d173a64678b199b21c0bc52ef17da56cec31f3eedc3685e68b394b7bc119e38b"
          HTTP_ALLOWED: "true"
          ALLOW_UNAUTHENTICATED: "false"
          # APPLICATION LEVEL CONCURRENCY LIMIT
          MAX_CONVERT_PROCESS: "1"  # Restricts the app to 1 conversion at a time to prevent CPU crowding

        securityContext:
          privileged: true

service:
  main:
    controller: main
    type: NodePort
    ports:
      http:
        port: 3050
        targetPort: 3000
        nodePort: 32050

persistence:
  data:
    enabled: true
    type: persistentVolumeClaim
    storageClass: "longhorn"
    accessMode: ReadWriteOnce
    size: 10Gi
    globalMounts:
      - path: /app/data
  igpu:
    enabled: true
    type: hostPath
    hostPath: /dev/dri
    globalMounts:
      - path: /dev/dri
# values.yaml
ingress:
  main:
    enabled: true
    className: nginx
    annotations:
      # AUTOMATED TLS FIX: Triggers cert-manager to provision the certificate
      cert-manager.io/cluster-issuer: "letsencrypt-production"
      # THE 502 FIX: Bridges to the unencrypted pod port 3050 safely
      nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
    hosts:
      - host: convertx.needlestack.boo
        paths:
          - path: /
            pathType: Prefix
            service:
              identifier: main
              port: 3050
    # AUTOMATED TLS FIX: Instructs NGINX where to store the secret
    tls:
      - secretName: convertx-tls-secret
        hosts:
          - convertx.needlestack.boo