Install Foggy (Self-Hosted)

# Foggy production values.
#
# Customize this file and install with:
#   helm install foggy foggy/foggy -n foggy -f values-production.yaml
#
# LLM provider API keys (Anthropic / OpenAI / OpenRouter / Azure) are NOT
# configured here — they are entered through the UI after first login
# (Settings → LLM Providers) and stored Fernet-encrypted in the database.

# --- PostgreSQL -------------------------------------------------------------
# Production default: external managed Postgres (AWS RDS, Cloud SQL, Azure
# Database, CloudNativePG, Neon, etc). Bundled Postgres is evaluation-only.
postgresql:
  enabled: false

externalDatabase:
  # URL scheme MUST start with `postgresql+asyncpg://` — Foggy's backend
  # uses SQLAlchemy's async engine, which requires an async driver.
  # Plain `postgres://` or `postgresql://` fails at startup with
  # `InvalidRequestError: The asyncio extension requires an async driver`.
  #
  # Most managed Postgres services (AWS RDS, Cloud SQL, Azure Database,
  # Neon) enforce TLS by default — append `?sslmode=require` to match.
  url: "postgresql+asyncpg://USER:PASSWORD@HOST:5432/DBNAME?sslmode=require"

  # Alternative: reference an existing Kubernetes Secret with a `url` key
  # (e.g. generated by external-secrets-operator from your secret manager):
  #   existingSecret: foggy-database-url
  #   existingSecretKey: url

# --- Ingress ----------------------------------------------------------------
# Turn on after you've verified first install via kubectl port-forward.
# Typical production shape: Ingress + cert-manager-issued TLS.
ingress:
  enabled: false
  # className: nginx
  # host: foggy.your-company.com
  # tls:
  #   enabled: true
  #   secretName: foggy-tls

# --- Kubernetes RBAC --------------------------------------------------------
# Default: cluster-wide read-only on workloads, services, pod logs, events.
# Narrow to specific namespaces if your security team requires it.
rbac:
  enabled: true
  scope: cluster  # or `namespace` + `namespaces: [ns1, ns2]`

# --- Admin bootstrap --------------------------------------------------------
# Default: chart generates a random admin password into the `foggy-admin`
# Secret. Alternative: disable generation and supply the Secret yourself.
# admin:
#   generatePassword: false
#   existingSecret: my-pre-created-foggy-admin

# --- Observability (opt-in) -------------------------------------------------
# OpenTelemetry traces/metrics/logs via OTLP/gRPC. Disabled by default.
# Set `observability.otel.endpoint` to your collector; the chart wires
# OTEL_EXPORTER_OTLP_ENDPOINT into both the console-backend and agent pods.
# observability:
#   otel:
#     endpoint: "http://otel-collector.observability.svc.cluster.local:4317"
#
# Langfuse (LLM tracing) — opt-in on the agent via extraEnv:
# agent:
#   extraEnv:
#     - name: LANGFUSE_PUBLIC_KEY
#       value: "pk-lf-..."
#     - name: LANGFUSE_SECRET_KEY
#       value: "sk-lf-..."
#     - name: LANGFUSE_HOST
#       value: "https://cloud.langfuse.com"
#
# PostHog (product analytics) — opt-in on the console backend via extraEnv:
# consoleBackend:
#   extraEnv:
#     - name: POSTHOG_API_KEY
#       value: "phc_..."