harbor:
  # Fresh install (helm list -n harbor came back empty — claude.md's "Just
  # installed this session" note was stale). Minimal footprint by request:
  # Trivy disabled (Notary/ChartMuseum aren't even in this chart anymore —
  # dropped upstream, not something to disable), database/redis are
  # Harbor's own required internal state (not optional the way Trivy is,
  # despite what I initially suggested), everything else trimmed.
  #
  # Plain HTTP, matching every other app here (Vault tls_disable, ArgoCD
  # --insecure, etc.) — avoids cert-manager entirely for this homelab.
  # Note: this only affects the ingress. Jenkins pushing images should go
  # through Harbor's internal cluster-DNS service (harbor-core.harbor.svc.cluster.local)
  # instead, per claude.md's own plan — pod-to-pod traffic never touches
  # the ingress, so no client-side insecure-registry config needed for CI.
  # Pulling/pushing from outside the cluster (e.g. your laptop) through the
  # ingress WOULD need Docker configured to treat this host as an insecure
  # registry, since there's no TLS here.
  expose:
    type: ingress
    tls:
      enabled: false
    ingress:
      hosts:
        core: "harbor.192.168.1.7.nip.io"
      className: contour

  externalURL: "http://harbor.192.168.1.7.nip.io"

  # Vault-backed from the start, same pattern as jenkins-admin-credentials.
  # See devops-infra-argo-config/secretstores/harbor-admin-credentials.yaml
  # and vault kv path secret/harbor/admin.
  existingSecretAdminPassword: harbor-admin-credentials
  existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD

  trivy:
    enabled: false

  persistence:
    enabled: true
    resourcePolicy: "keep"
    persistentVolumeClaim:
      registry:
        storageClass: local-path
        size: 5Gi
      jobservice:
        jobLog:
          storageClass: local-path
          size: 1Gi
      database:
        storageClass: local-path
        size: 1Gi
      redis:
        storageClass: local-path
        size: 1Gi

  portal:
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        memory: 256Mi

  core:
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        memory: 512Mi

  jobservice:
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        memory: 256Mi

  registry:
    registry:
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          memory: 256Mi
    controller:
      resources:
        requests:
          cpu: 50m
          memory: 64Mi
        limits:
          memory: 128Mi

  database:
    internal:
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          memory: 512Mi

  redis:
    internal:
      resources:
        requests:
          cpu: 50m
          memory: 64Mi
        limits:
          memory: 128Mi