simstudioai--sim/helm/sim/examples/values-external-db.yaml

# values-external-db.yaml
#
# When to use: production deployments that use a managed Postgres service
# (AWS RDS, Azure Database for PostgreSQL, Google Cloud SQL, Neon, Supabase)
# instead of the chart's in-cluster Postgres StatefulSet. The in-cluster
# Postgres is disabled (postgresql.enabled=false).
#
# Prerequisites:
#   - A reachable managed Postgres instance with pgvector extension available
#   - DB credentials provisioned (user, password, database)
#   - Network reachability from the cluster (peering, private link, or public
#     endpoint with TLS)
#
# Install — generate each secret first in the same shell:
#   export BETTER_AUTH_SECRET=$(openssl rand -hex 32)
#   export ENCRYPTION_KEY=$(openssl rand -hex 32)
#   export INTERNAL_API_SECRET=$(openssl rand -hex 32)
#   export CRON_SECRET=$(openssl rand -hex 32)
#   export DB_PASSWORD=$(openssl rand -hex 24)
#
#   helm install sim ./helm/sim \
#     --namespace sim --create-namespace \
#     --values ./helm/sim/examples/values-external-db.yaml \
#     --set externalDatabase.host=your-db.example.com \
#     --set externalDatabase.username=simstudio_user \
#     --set externalDatabase.password="$DB_PASSWORD" \
#     --set externalDatabase.database=simstudio_prod \
#     --set "networkPolicy.egress[0].to[0].ipBlock.cidr=10.20.0.0/24" \
#     --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
#     --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
#     --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
#     --set app.env.CRON_SECRET="$CRON_SECRET"

# Global configuration
global:
  imageRegistry: "ghcr.io"

# Main application
app:
  enabled: true
  replicaCount: 2
  
  resources:
    limits:
      memory: "4Gi"
      cpu: "2000m"
    requests:
      memory: "2Gi"
      cpu: "1000m"
  
  env:
    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
    BETTER_AUTH_URL: "https://simstudio.acme.com"
    SOCKET_SERVER_URL: "https://simstudio-ws.acme.com"
    NEXT_PUBLIC_SOCKET_URL: "https://simstudio-ws.acme.com"
    
    # Security settings (REQUIRED - replace with your own secure secrets)
    # Generate using: openssl rand -hex 32
    BETTER_AUTH_SECRET: ""  # Set via --set flag or external secret manager
    ENCRYPTION_KEY: ""      # Set via --set flag or external secret manager
    INTERNAL_API_SECRET: "" # Set via --set flag or external secret manager
    CRON_SECRET: ""         # Set via --set flag or external secret manager

    # Optional: API Key Encryption (RECOMMENDED for production)
    # Generate 64-character hex string using: openssl rand -hex 32
    API_ENCRYPTION_KEY: ""  # Optional but recommended - encrypts API keys at rest
    
    NODE_ENV: "production"
    NEXT_TELEMETRY_DISABLED: "1"

# Realtime service
realtime:
  enabled: true
  # Safe to scale past 1: Socket.IO bridges cross-pod events through its Redis
  # adapter, and the chart bundles Redis by default. Only keep this at 1 if you
  # set redis.enabled=false without supplying app.env.REDIS_URL..
  replicaCount: 1
  
  resources:
    limits:
      memory: "4Gi"
      cpu: "1000m"
    requests:
      memory: "2Gi"
      cpu: "500m"
  
  env:
    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
    BETTER_AUTH_URL: "https://simstudio.acme.com"
    BETTER_AUTH_SECRET: ""  # Must match main app secret - set via --set flag
    ALLOWED_ORIGINS: "https://simstudio.acme.com"
    NODE_ENV: "production"

# Database migrations
migrations:
  enabled: true
  
  resources:
    limits:
      memory: "2Gi"
      cpu: "1000m"
    requests:
      memory: "1Gi"
      cpu: "500m"

# Disable internal PostgreSQL
postgresql:
  enabled: false

# Configure external database connection
externalDatabase:
  enabled: true
  
  # Database connection details (REQUIRED - configure for your external database)
  host: "postgres.acme.com"   # REQUIRED - your database hostname (RDS/Cloud SQL/Azure endpoint or IP)
  port: 5432
  username: "simstudio_user"  # REQUIRED - your database username
  password: ""                # Database password - set via --set flag or external secret
  database: ""                # Database name (e.g., "simstudio_production")
  
  # SSL mode for database connections (recommended: 'require' for production)
  sslMode: "require"          # Options: disable, allow, prefer, require, verify-ca, verify-full

# Ollama (optional for AI models)
ollama:
  enabled: false

# Ingress configuration
ingress:
  enabled: true
  className: nginx
  
  annotations:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
  
  app:
    host: simstudio.acme.com
    paths:
      - path: /
        pathType: Prefix
  
  realtime:
    host: simstudio-ws.acme.com
    paths:
      - path: /
        pathType: Prefix
  
  tls:
    enabled: true
    secretName: simstudio-tls-secret

# Production-ready features (autoscaling, monitoring, etc.)
autoscaling:
  enabled: true
  # Realtime scales with the app because Redis is available by default. Set this
  # to false only if you run without Redis (redis.enabled=false and no
  # app.env.REDIS_URL) — multi-replica realtime would drop cross-pod events.
  realtime:
    enabled: false
  minReplicas: 2
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

podDisruptionBudget:
  enabled: true
  minAvailable: null
  maxUnavailable: 1  
  unhealthyPodEvictionPolicy: AlwaysAllow 
monitoring:
  serviceMonitor:
    enabled: true
    labels:
      monitoring: "prometheus"
    interval: 15s

networkPolicy:
  enabled: true
  # `networkPolicy.egress` is a LIST of NetworkPolicy egress rules. With the
  # policy on, the chart's egress allowlist only covers the in-cluster
  # Postgres, so this rule is what lets the pods reach your external database.
  # The CIDR below is an example, exactly like `your-db.example.com` in the
  # install command: REQUIRED to change — set your database's subnet (or /32
  # host) via the --set line in the install commands below, or edit it here.
  # A wrong CIDR blocks migrations and every database connection; an empty
  # `to:` would allow ANY host on 5432 and defeat the isolation.
  egress:
    - to:
        - ipBlock:
            cidr: 10.0.0.0/16 # REQUIRED - your database subnet or /32 host CIDR
      ports:
        - protocol: TCP
          port: 5432

# Example deployment command with secure secret generation:
# helm install sim ./helm/sim \
#   --values ./helm/sim/examples/values-external-db.yaml \
#   --set externalDatabase.host="your-db-host.com" \
#   --set externalDatabase.username="your-db-user" \
#   --set externalDatabase.password="your-db-password" \
#   --set externalDatabase.database="your-db-name" \
#   --set "networkPolicy.egress[0].to[0].ipBlock.cidr=10.20.0.0/24" \
#   --set app.env.BETTER_AUTH_SECRET="$(openssl rand -hex 32)" \
#   --set app.env.ENCRYPTION_KEY="$(openssl rand -hex 32)" \
#   --set app.env.INTERNAL_API_SECRET="$(openssl rand -hex 32)" \
#   --set app.env.CRON_SECRET="$(openssl rand -hex 32)" \
#   --set app.env.API_ENCRYPTION_KEY="$(openssl rand -hex 32)" \
#   --set realtime.env.BETTER_AUTH_SECRET="$(openssl rand -hex 32)"