# Configuration: Using Kubernetes Secrets for All Sensitive Values
# Usage: helm install bifrost ./bifrost -f values-examples/secrets-from-k8s.yaml
#
# This example demonstrates how to use existing Kubernetes secrets for all
# sensitive values instead of putting them directly in the values file.
#
# Prerequisites:
# 1. Create the required Kubernetes secrets before installing the chart:
#
#    # PostgreSQL password secret
#    kubectl create secret generic postgres-credentials \
#      --from-literal=password='your-postgres-password'
#
#    # Encryption key secret
#    kubectl create secret generic bifrost-encryption \
#      --from-literal=key='your-encryption-key'
#
#    # Provider API keys secret
#    kubectl create secret generic provider-api-keys \
#      --from-literal=openai-api-key='sk-...' \
#      --from-literal=anthropic-api-key='sk-ant-...'
#
#    # Qdrant API key secret (if using Qdrant)
#    kubectl create secret generic qdrant-credentials \
#      --from-literal=api-key='your-qdrant-api-key'

# Storage configuration
storage:
  mode: postgres
  configStore:
    enabled: true
  logsStore:
    enabled: true

# External PostgreSQL with credentials from Kubernetes secret
postgresql:
  enabled: false
  external:
    enabled: true
    host: "your-postgres-host.example.com"
    port: 5432
    user: bifrost
    database: bifrost
    sslMode: require
    # Reference existing Kubernetes secret for password
    existingSecret: "postgres-credentials"
    passwordKey: "password"

# Vector store with API key from Kubernetes secret
vectorStore:
  enabled: true
  type: qdrant
  qdrant:
    enabled: false
    external:
      enabled: true
      host: "your-qdrant-host.example.com"
      port: 6334
      useTls: true
      # Reference existing Kubernetes secret for API key
      existingSecret: "qdrant-credentials"
      apiKeyKey: "api-key"

# Bifrost configuration
bifrost:
  # Encryption key from Kubernetes secret
  encryptionKeySecret:
    name: "bifrost-encryption"
    key: "key"
  
  client:
    enableLogging: true
  
  # Provider configurations using env.VAR_NAME syntax
  # The actual values come from providerSecrets below
  providers:
    openai:
      keys:
        - value: "env.OPENAI_API_KEY"
          weight: 1
    anthropic:
      keys:
        - value: "env.ANTHROPIC_API_KEY"
          weight: 1
  
  # Provider secrets - inject API keys from Kubernetes secrets as env vars
  providerSecrets:
    openai:
      existingSecret: "provider-api-keys"
      key: "openai-api-key"
      envVar: "OPENAI_API_KEY"
    anthropic:
      existingSecret: "provider-api-keys"
      key: "anthropic-api-key"
      envVar: "ANTHROPIC_API_KEY"
  
  plugins:
    # Maxim plugin with API key from secret
    maxim:
      enabled: false  # Set to true if using Maxim
      config:
        log_repo_id: "your-log-repo-id"
      secretRef:
        name: "maxim-credentials"
        key: "api-key"