contour:
  # This is your live `helm get values contour -n projectcontour` output,
  # verbatim. This is the ingress for everything else in this repo
  # (Gitea, ArgoCD, Vault all route through it) — don't tune this without
  # re-checking those still resolve afterward.
  #
  # hostPorts, not a Service type=LoadBalancer: claude.md issue #6 — MetalLB
  # got a floating IP fine, but this VM's host (VMware Workstation, Bridged
  # networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP
  # was never reachable from outside the VM. hostPort on Envoy binds
  # directly to the node's real NIC instead — confirmed working by the live
  # DaemonSet's actual container ports (checked before writing this file,
  # not assumed): envoy container has hostPort 80/443 exactly matching
  # envoy.hostPorts below, so this really is Helm-values-driven, not a
  # hidden out-of-band kubectl patch.
  #
  # This is also why ArgoCD's default Ingress health check needed
  # overriding (see argocd-admin-prd/custom-values.yaml) — there's no
  # Service type=LoadBalancer here to ever populate
  # status.loadBalancer.ingress.

  contour:
    resources:
      limits:
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi

  envoy:
    dnsPolicy: ClusterFirstWithHostNet
    hostNetworking: true
    hostPorts:
      enabled: true
      http: 80
      https: 443
    resources:
      limits:
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi
    service:
      type: ClusterIP