replicaCount: 1

image:
  repository: lbtelegram
  tag: latest
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 256Mi

env:
  PORT: "8081"
  ENV: ""
  BOT_COUNT: ""
  GATEWAY_URL: ""
  BOT1_USERNAME: ""
  BOT2_USERNAME: ""
  JWT_TTL_SECONDS: ""
  LB_STRATEGY: ""
  HEALTH_CHECK_INTERVAL: ""
  BACKEND_LINK_URL: ""

secrets:
  BOT1_TOKEN: ""
  BOT2_TOKEN: ""
  BOT1_WEBHOOK_SECRET: ""
  BOT2_WEBHOOK_SECRET: ""
  BACKEND_LINK_SECRET: ""
  JWT_SECRET: ""
  # DSN complets (identifiants inclus) — à générer par le worker de provisioning
  # vers les services postgresql/redis du même namespace de démo.
  DATABASE_URL: ""
  REDIS_URL: ""

podAnnotations: {}

podSecurityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL

service:
  type: ClusterIP
  port: 8081

# Routage public des webhooks Telegram (/webhook/bot1, /webhook/bot2...) via
# le Traefik partagé. host vide => pas d'IngressRoute créée (voir
# templates/ingressroute.yaml).
host: ""
traefikNamespace: traefik