# GitOps demo release — full copy of production, source read from
# git.vinmec.tech/VuQuangBao/duocthu instead of GitHub. Separate EC2, separate
# cluster, own Postgres/Qdrant (single-release, not split like production —
# this box is short-lived and disposable, the split's prune-safety benefit
# does not matter here).
#
# Real secrets (grafana/jwt/postgres passwords) are generated fresh for this
# box and stay inline on the ArgoCD Application, same pattern as production —
# never in this tracked file.

global:
  environment: gitea-demo
  imagePullSecrets:
    - name: ghcr-pull-secret

aiService:
  config:
    embeddingProvider: cohere-v4
    embeddingDimensions: 1024
    evidenceMinimumScore: 0.12
    awsRegion: us-east-1
    answerProvider: bedrock-converse
    answerModelId: qwen.qwen3-next-80b-a3b
    rerankEnabled: true
    qdrantCollection: duocthu_v1
    metricsEnabled: true
    otelEnabled: true
    otelSampleRatio: 1.0

authService:
  enabled: true

apiGateway:
  enabled: true

postgres:
  enabled: true

qdrant:
  enabled: true

observability:
  enabled: true
  grafana:
    anonymous:
      enabled: true
      role: Viewer

ingress:
  enabled: true
  className: traefik
  host: finalduocthu.realvuxbaro.me
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  # DNS confirmed resolving to this box before this block was added -- same
  # ordering that let the 2026-08-17 cutover issue its cert on the first
  # attempt instead of burning failed-validation ACME orders.
  tls:
    - hosts:
        - finalduocthu.realvuxbaro.me
      secretName: finalduocthu-tls