# override the chart name
nameOverride: {{ nameOverride | default('vantage6-node') }}
# Optional, by default the Release.Namespace is used
# namespace: vantage6-node
node:

  name: {{ node.name | default('put-your-node-name-here') }}
  apiKey: {{ node.apiKey | default('put-your-api-key-here') }}

  # Keycloak configuration
  keycloak:
    url: {{ node.keycloak.url | default('http://vantage6-auth-kc-service.vantage6.svc.cluster.local:7680') }}
    realm: {{ node.keycloak.realm | default('vantage6') }}

  # Settings for HQ to connect to.
  hq:
    url: {{ node.hq.url }}
    port: {{ node.hq.port | default(7601) }}
    path: {{ node.hq.path | default('/hq') }}

  {% if node.image is defined %}
  # Fixed image to use to run the node. Note that if specified, the node will not
  # automatically run the version matching the HQ version.
  image: {{ node.image }}
  {% else %}
  # You may specify a fixed image to use to run the node. Note that if specified, the
  # node will not automatically run the version matching the HQ version.
  # image: harbor2.vantage6.ai/infrastructure/node:uluru
  {% endif %}

  # Node image pull policy.
  # Possible values are:
  # - Always: always pull the image from the registry
  # - IfNotPresent: pull the image from the registry if it is not present on the node
  # - Never: never pull the image from the registry
  imagePullPolicy: {{ node.imagePullPolicy | default('Always') }}

  # Namespace in which the task kubernetes resources are created. This must be a
  # namespace where the node has access to create pods.
  taskNamespace: {{ node.taskNamespace | default('vantage6-tasks') }}

  # Kubernetes node name, used for local persistent volumes
  k8sNodeName: {{ node.k8sNodeName | default('docker-desktop') }}

  logging:
    # Controls the logging output level. Could be one of the following
    # levels: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET
    level: {{ node.logging.level | default('INFO') }}

    # Location to the log file
    file: {{ node.logging.file | default('node.log') }}

    # Size of the kubernetes persistent volume claim for logs
    storageSize: {{ node.logging.storageSize | default('1Gi') }}

    # Storage class to use for the kubernetes persistent volume claim for logs
    storageClass: {{ node.logging.storageClass | default('local-storage') }}

    # Host path for storing the logs (required for local-storage PV)
    volumeHostPath: {{ node.logging.volumeHostPath | default('/var/log/vantage6-node') }}

    # Size in kb of a single log file
    max_size: {{ node.logging.max_size | default(1024) }}
    use_console: {{ node.logging.use_console | default(true) }}

    # Date format for the log file
    datefmt: "{{ node.logging.datefmt | default('%Y-%m-%d %H:%M:%S') }}"

    # Format for the log file
    format: "{{ node.logging.format | default('%(asctime)s - %(name)-14s - %(levelname)-8s - %(message)s') }}"

    # Maximum number of log files to keep. Log files are rotated when the size of the
    # current log file exceeds `max_size`.
    backup_count: {{ node.logging.backup_count | default(5) }}

    # Loggers to include in the log file
    loggers:
    {% if node.logging.loggers is defined %}
    {% for logger in node.logging.loggers %}
    - level: {{ logger.level }}
      name: {{ logger.name }}
    {% endfor %}
    {% endif %}
    {% if node.logging.loggers is not defined %}
    - level: warning
      name: urllib3
    - level: warning
      name: socketIO-client
    - level: warning
      name: socketio.server
    - level: warning
      name: engineio.server
    - level: warning
      name: sqlalchemy.engine
    - level: warning
      name: kubernetes.client.rest
    {% endif %}

  {% if node.encryption is defined %}
  encryption:
    # Whether encryption is enabled or not. This should be the same as the `encrypted`
    # setting of the collaboration to which this node belongs.
    enabled: {{ node.encryption.enabled | default(false) }}

    # Location to the private key file. Required if encryption is enabled.
    {% if node.encryption.private_key is defined and node.encryption.private_key != '' %}
    private_key: {{ node.encryption.private_key | default('/path/to/private_key.pem') }}
    {% else %}
    # private_key: /path/to/private_key.pem
    {% endif %}
  {% else %}
  encryption:
    # Whether encryption is enabled or not. This should be the same as the `encrypted`
    # setting of the collaboration to which this node belongs.
    enabled: false

    # Location to the private key file. Required if encryption is enabled.
    # private_key: /path/to/private_key.pem
  {% endif %}

  # Port for the node proxy to run on
  proxyPort: {{ node.proxyPort | default(7654) }}

  # Storage settings on host of the node machine. This defines where the database is
  # stored as well as the task directory (which will contain the input/output of the
  # tasks).
  persistence:
    tasks:
      {% if node.persistence is defined and node.persistence.tasks is defined %}
      storageClass: {{ node.persistence.tasks.storageClass | default('local-storage') }}
      size: {{ node.persistence.tasks.size | default('10Gi') }}
      hostPath: {{ node.persistence.tasks.hostPath | default('/path/to/where/task/files/are/stored') }}
      {% else %}
      storageClass: local-storage
      size: 10Gi
      hostPath: /path/to/where/task/files/are/stored
      {% endif %}
    database:
      {% if node.persistence is defined and node.persistence.database is defined %}
      storageClass: {{ node.persistence.database.storageClass | default('local-storage') }}
      size: {{ node.persistence.database.size | default('5Gi') }}
      {% else %}
      storageClass: local-storage
      size: 5Gi
      {% endif %}


  # It is also possible not to specify the details of the service-based databases
  # here. The node will then automatically detect the databases in the environment
  # variables. This allows parent charts to specify the databases in their own
  # values.yaml file or define them runtime using the CLI.
  #
  # In this case, the node expects the following environment variables to be set:
  #
  # DATABASE_LABELS: comma-separated list of database labels
  # DATABASE_[LABEL]_URI: URI of the database
  # DATABASE_[LABEL]_TYPE: type of the database
  #
  # Optionally, you can also specify additional environment variables for each
  # database by setting the DATABASE_[LABEL]_SOME_OTHER_KEY variable.
  #
  # DATABASE_[LABEL]_SOME_OTHER_KEY: some_other_value
  #
  # It is recommended to do this through Kubernetes secrets. If you specify the
  # details here, secrets will be used. File-based databases are automatically made
  # available to your node.
  {% if node.databases is defined %}
  databases:
    {% if node.databases.fileBased is defined %}
    fileBased:
    {% for db in node.databases.fileBased %}
    - name: {{ db.name }}
      uri: {{ db.uri }}
      type: {{ db.type }}
      volumePath: {{ db.volumePath }}
      originalName: {{ db.originalName }}
    {% endfor %}
    {% endif %}
    {% if node.databases.serviceBased is defined %}
    serviceBased:
    {% for db in node.databases.serviceBased %}
    - name: {{ db.name }}
      uri: {{ db.uri }}
      type: {{ db.type }}
      env:
        {% for key, value in db.env.items() %}
        {{ key }}: {{ value }}
        {% endfor %}
    {% endfor %}
    {% endif %}
  {% else %}
  databases: []
  {% endif %}

  # Whether or not your node shares some configuration (e.g. which images are
  # allowed to run on your node) with HQ. This can be useful
  # for other organizations in your collaboration to understand why a task
  # is not completed. Obviously, no sensitive data is shared. Default true
  share_config: {{ node.share_config | default(true) }}

  # Whether or not to share algorithm logs with HQ. Otherwise they will
  # only be displayed as part of the node logs. Default is true.
  # NOTE: It's recommented to set this to false when using sensitive data
  share_algorithm_logs: {{ node.share_algorithm_logs | default(true) }}

  # Define who is allowed to run which algorithms on this node.
  {% if node.policies is defined %}
  policies:
    # Control which algorithm images are allowed to run on this node. This is
    # expected to be a valid regular expression. If you don't specify this, all algorithm
    # images are allowed to run on this node (unless other policies restrict this).
    {% if node.policies.allowed_algorithms is defined %}
    allowed_algorithms:
      {% for algo in node.policies.allowed_algorithms %}
      - {{ algo }}
      {% endfor %}
    {% else %}
    # allowed_algorithms:
    #   - ^harbor2\.vantage6\.ai/[a-zA-Z]+/[a-zA-Z]+
    #   - ^myalgorithm\.ai/some-algorithm
    {% endif %}

    # It is also possible to allow all algorithms from particular algorithm stores. Set
    # these stores here. They may be strings or regular expressions. If you don't specify
    # this, algorithms from any store are allowed (unless other policies prevent this).
    {% if node.policies.allowed_algorithm_stores is defined %}
    allowed_algorithm_stores:
      {% for store in node.policies.allowed_algorithm_stores %}
      - {{ store }}
      {% endfor %}
    {% else %}
    # allowed_algorithm_stores:
    #   # allow all algorithms from the vantage6 community store
    #   - https://store.uluru.vantage6.ai
    #   # allow any store that is a subdomain of vantage6.ai
    #   - ^https://[a-z]+\.vantage6\.ai$
    {% endif %}

    # If you define both `allowed_algorithm_stores` and `allowed_algorithms`, you can
    # choose to only allow algorithms that both policies allow, or you can allow
    # algorithms that either of them allows. By default, only algorithms that are given
    # in *both* the `allowed_algorithms` and `allowed_algorithm_stores` are allowed by
    # setting this to the default value `false`.
    allow_either_whitelist_or_store: {{ node.policies.allow_either_whitelist_or_store | default(false) }}

    # Define which users are allowed to run algorithms on your node by their ID
    {% if node.policies.allowed_users is defined %}
    allowed_users:
      {% for user in node.policies.allowed_users %}
      - {{ user }}
      {% endfor %}
    {% else %}
    # allowed_users:
    #   - 2
    {% endif %}

    # Define which organizations are allowed to run images on your node by
    # their ID or name
    {% if node.policies.allowed_organizations is defined %}
    allowed_organizations:
      {% for org in node.policies.allowed_organizations %}
      - {{ org }}
      {% endfor %}
    {% else %}
    # allowed_organizations:
    #   - 6
    #   - root
    {% endif %}

    # Set to true to always require that the algorithm image is successfully pulled. This
    # ensures that no potentially outdated local images are used if internet connection
    # is not available. This option should be set to false if you are testing with local
    # algorithm images. Default value is true.
    require_algorithm_pull: {{ node.policies.require_algorithm_pull | default(true) }}
  {% else %}
  policies:
    # Control which algorithm images are allowed to run on this node. This is
    # expected to be a valid regular expression. If you don't specify this, all algorithm
    # images are allowed to run on this node (unless other policies restrict this).
    # allowed_algorithms:
    #   - ^harbor2\.vantage6\.ai/[a-zA-Z]+/[a-zA-Z]+
    #   - ^myalgorithm\.ai/some-algorithm

    # It is also possible to allow all algorithms from particular algorithm stores. Set
    # these stores here. They may be strings or regular expressions. If you don't specify
    # this, algorithms from any store are allowed (unless other policies prevent this).
    # allowed_algorithm_stores:
    #   # allow all algorithms from the vantage6 community store
    #   - https://store.uluru.vantage6.ai
    #   # allow any store that is a subdomain of vantage6.ai
    #   - ^https://[a-z]+\.vantage6\.ai$

    # If you define both `allowed_algorithm_stores` and `allowed_algorithms`, you can
    # choose to only allow algorithms that both policies allow, or you can allow
    # algorithms that either of them allows. By default, only algorithms that are given
    # in *both* the `allowed_algorithms` and `allowed_algorithm_stores` are allowed by
    # setting this to the default value `false`.
    # allow_either_whitelist_or_store: false

    # Define which users are allowed to run algorithms on your node by their ID
    # allowed_users:
    #   - 2
    # Define which organizations are allowed to run images on your node by
    # their ID or name
    # allowed_organizations:
    #   - 6
    #   - root

    # Set to true to always require that the algorithm image is successfully pulled. This
    # ensures that no potentially outdated local images are used if internet connection
    # is not available. This option should be set to false if you are testing with local
    # algorithm images. Default value is true.
    require_algorithm_pull: true
  {% endif %}

  # Prometheus settings, for sending system metadata to HQ.
  {% if node.prometheus is defined %}
  prometheus:
    # Whether or not to enable Prometheus reporting. Default is false.
    enabled: {{ node.prometheus.enabled | default(false) }}

    # Interval (in seconds) at which the node sends system metadata to HQ.
    # This should align with the Prometheus scrape_interval to avoid stale data.
    report_interval_seconds: {{ node.prometheus.report_interval_seconds | default(45) }}
  {% else %}
  prometheus:
    # Whether or not to enable Prometheus reporting. Default is false.
    enabled: false

    # Interval (in seconds) at which the node sends system metadata to HQ.
    # This should align with the Prometheus scrape_interval to avoid stale data.
    # report_interval_seconds: 45
  {% endif %}

  # Specify private Docker registries so that the node can login and pull private
  # algorithms.
  {% if node.private_docker_registries is defined %}
  private_docker_registries:
    {% for registry in node.private_docker_registries %}
    - registry: {{ registry.registry }}
      username: {{ registry.username }}
      password: {{ registry.password }}
    {% endfor %}
  {% else %}
  # private_docker_registries:
  #   - registry: my-private-registry.com
  #     username: my-username
  #     password: my-password
  {% endif %}

  # Provide additional environment variables to the algorithm containers. This can be
  # useful for instance to provide threshold values, database credentials, etc.
  # Note that variable names should consist of only letters, numbers and underscores,
  # and start with a letter.
  {% if node.algorithm_env is defined %}
  algorithm_env:
    {% for key, value in node.algorithm_env.items() %}
    {{ key }}: {{ value }}
    {% endfor %}
  {% else %}
  # algorithm_env:
  #     threshold_example: 10
  {% endif %}

  # Whitelisting settings to specify external addresses algorithms are allowed to
  # connect to. Only Kubernetes network policies are supported. See:
  #   https://kubernetes.io/docs/concepts/services-networking/network-policies
  # Only add egress destinations that are absolutely necessary for your algorithm
  # to function (for example, a required database server). Whitelists are defined
  # per task type. The allowed task types are: data_extraction, preprocessing,
  # federated_compute, central_compute, postprocessing.
  #
  # Each entry in the whitelist defines one allowed connection path. Multiple entries
  # are OR'd together (traffic is allowed if it matches any entry). You can specify:
  # - namespaceSelector: to allow connections to all pods in a namespace or a subset of
  #   pods in a namespace when used in combination with podSelector
  # - podSelector: to allow connections to pods matching labels (make sure that the
  #   namespace of this pod is whitelisted)
  # - ipBlock: to allow connections to IP addresses or CIDR ranges (e.g. a database
  #   server that is not part of the cluster)
  # whitelist:
  #   data_extraction:
  #     egress:
  #       - namespaceSelector:
  #         matchExpressions:
  #         - key: namespace
  #           operator: In
  #           values: ["some-namespace", "another-namespace"]
  #   preprocessing:
  #     egress: []
  #   federated_compute:
  #     egress: []
  #   central_compute:
  #     egress: []
  #   postprocessing:
  #     egress: []

  # Set to false to prevent creation of node secrets (useful when secrets are managed
  # externally)
  createSecrets: {{ node.createSecrets | default(true) }}

  {% if node.debug is defined %}
  # Debug settings
  debug:
    # Set to `true` to enable print debug messages from Flask/socketio.
    socketio: {{ node.debug.socketio | default(false) }}

    # Set to `true` to set the Flask app used for proxy service into debug mode.
    proxy_server: {{ node.debug.proxy_server | default(false) }}
  {% endif %}

  {% if node.dev is defined %}
  dev:
    # Set extension for the task directory. In the development environment, the task
    # directory is mounted as a volume. If multiple nodes are then running on the same
    # machine, this extension is added to the task directory to avoid conflicts.
    task_dir_extension: {{ node.dev.task_dir_extension }}
  {% endif %}
