# logHouse (central-prd) - overrides only.
# Google SSO via oauth2-proxy; ClickHouse ingress disabled.
oauth2Proxy:
  enabled: true

# nginx audit proxy maps X-Forwarded-Email → X-ClickHouse-Setting-log_comment
# so system.query_log.log_comment shows the SSO email of who ran each query.
auditProxy:
  enabled: true
  replicas: 2
  image: "nginx:1.27-alpine"
  tolerations:
    - key: "cloud.google.com/compute-class"
      operator: "Equal"
      value: "loghouse"
      effect: "NoSchedule"

externalSecret:
  enabled: true
  path: meesho/prd/cntr/devop/loghouse
  secretName: loghouse-oauth2-secret
  annotations: {}

# --- Bitnami ClickHouse subchart ---
clickhouse:
  replicaCount: 3
  global:
    security:
      allowInsecureImages: true

  image:
    registry: asia-southeast1-docker.pkg.dev
    repository: meesho-devops-admin-0622/prd/sis/clickhouse
    tag: 25.6.2-debian-12-r0

  auth:
    username: default
    password: ""
    existingSecret: "loghouse-oauth2-secret"
    existingSecretKey: "clickhouse-password"


  # Enable sampling so Bitnami's 08-sampling.xml preserves query_log,
  # text_log, metric_log etc. All queries are recorded in system.query_log.
  sampling:
    enabled: true

  usersdFiles:
    grant_all.xml: |
      <yandex>
        <users>
          <default>
            <access_management>1</access_management>
            <named_collection_control>1</named_collection_control>
          </default>
        </users>
      </yandex>
    log_queries.xml: |
      <clickhouse>
        <profiles>
          <default>
            <log_queries>1</log_queries>
            <log_query_threads>0</log_query_threads>
          </default>
        </profiles>
      </clickhouse>

  initContainers:
    - name: copy-usersd-config
      image: busybox:1.36
      command:
        - /bin/sh
        - -ec
        - cp -R /src/. /dst/
      volumeMounts:
        - name: usersd-configuration-configuration
          mountPath: /src
          readOnly: true
        - name: clickhouse-users-d
          mountPath: /dst

  persistence:
    storageClass: "hyperdisk-balanced"
    size: 100Gi
    mountPath: /var/lib/clickhouse


  extraEnvVars:
    - name: CLICKHOUSE_USER
      value: "default"
    - name: CLICKHOUSE_PASSWORD
      valueFrom:
        secretKeyRef:
          name: loghouse-oauth2-secret
          key: clickhouse-password
  extraVolumes:
    - name: clickhouse-users-d
      emptyDir:
        sizeLimit: 100Mi
    - name: clickhouse-logs
      emptyDir:
        sizeLimit: 500Mi
    - name: fluentbit-config
      configMap:
        name: loghouse-fluentbit-config
  extraVolumeMounts:
    - name: clickhouse-users-d
      mountPath: /etc/clickhouse-server/users.d
    - name: clickhouse-logs
      mountPath: /var/log/clickhouse-server

  sidecars:
    - name: query-log-tailer
      image: "asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/sis/clickhouse:25.6.2-debian-12-r0"
      command:
        - /bin/sh
        - -c
        - |
          while true; do
            clickhouse-client --host 127.0.0.1 --port 9000 --user default --password "$CLICKHOUSE_PASSWORD" --query="SELECT event_time, user, query_id, query, client_hostname FROM system.query_log WHERE type = 'QueryFinish' AND event_time > now() - INTERVAL 10 SECOND FORMAT JSONEachRow" 2>/dev/null;
            sleep 10;
          done
      env:
        - name: CLICKHOUSE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: loghouse-oauth2-secret
              key: clickhouse-password
      volumeMounts:
        - name: clickhouse-logs
          mountPath: /var/log/clickhouse-server
          readOnly: true
      resources:
        requests:
          cpu: 10m
          memory: 32Mi
        limits:
          cpu: 50m
          memory: 64Mi
    - name: fluentbit
      image: fluent/fluent-bit:3.1
      resources:
        requests:
          cpu: 25m
          memory: 50Mi
        limits:
          cpu: 100m
          memory: 100Mi
      volumeMounts:
        - name: clickhouse-logs
          mountPath: /var/log/clickhouse-server
          readOnly: true
        - name: fluentbit-config
          mountPath: /fluent-bit/etc
          readOnly: true

  defaultInitContainers:
    volumePermissions:
      enabled: false
      image:
        registry: asia-southeast1-docker.pkg.dev
        repository: meesho-devops-admin-0622/prd/sis/os-shell
        tag: 12-debian-12-r47

  resourcesPreset: "none"
  # Chart maps these inversely: values.requests -> pod limits, values.limits -> pod requests
  resources:
    requests:
      cpu: "6"
      memory: 40Gi
    limits:
      cpu: "6"
      memory: 40Gi

  tolerations:
    - key: "cloud.google.com/compute-class"
      operator: "Equal"
      value: "loghouse"
      effect: "NoSchedule"

  # Disabled when oauth2Proxy.enabled is true (oauth2-proxy handles ingress)
  ingress:
    enabled: false

  networkPolicy:
    enabled: true
    allowExternal: true
    allowExternalEgress: true

  keeper:
    enabled: false


oauth2-proxy:
  replicaCount: 3
  config:
    existingSecret: loghouse-oauth2-secret
    requiredSecretKeys:
      - client-id
      - client-secret
      - cookie-secret
  extraArgs:
    provider: google
    redirect-url: "http://loghouse-central.prd.meesho.int/oauth2/callback"
    upstream: "http://loghouse-central-a-prd-audit-proxy:8123"
    email-domain: "meesho.com"
    proxy-prefix: "/oauth2"
    pass-host-header: "true"
    proxy-websockets: "true"
    real-client-ip-header: "X-Forwarded-For"
    cookie-secure: "false"
    cookie-expire: "0s"
    custom-templates-dir: "/templates"
    skip-jwt-bearer-tokens: "true"
    oidc-issuer-url: "https://accounts.google.com"
    extra-jwt-issuers: "https://accounts.google.com=32555940559.apps.googleusercontent.com"
    pass-user-headers: "true"
    set-xauthrequest: "true"
    request-logging: "true"
    auth-logging: "true"
    standard-logging: "true"
  extraVolumes:
    - name: custom-templates
      configMap:
        name: '{{ .Release.Name }}-oauth2-proxy-templates'
  extraVolumeMounts:
    - name: custom-templates
      mountPath: /templates
      readOnly: true
  service:
    portNumber: 80
  ingress:
    enabled: true
    className: contour-internal-1
    path: /
    pathType: Prefix
    hosts:
      - loghouse-central.prd.meesho.int
    annotations: {}
    tls: []
  sessionStorage:
    type: cookie
  redis-ha:
    enabled: false
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 128Mi