{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "chart": {
      "type": "string",
      "description": "Chart to render. Defaults to `webapp`."
    },
    "requiredSecretKeys": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "GitHub Environment Secret keys to seal into the app's Secret and inject into the pod."
    },
    "requiredVarKeys": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "GitHub Environment Variable keys to inject into the pod."
    },
    "includeSecretKeys": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "micromatch pattern(s) for additional secret keys to include from the available deploy secrets. Default: `\"!*\"` (none). Use `\"*\"` for all."
    },
    "includeVarKeys": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "micromatch pattern(s) for additional var keys to include from the available deploy variables. Default: `\"!*\"` (none). Use `\"*\"` for all."
    },
    "expandDatabaseUrl": {
      "type": "string",
      "description": "Name of a secret key holding a database URL to parse into individual components (`DB_HOST`, `DB_PORT`, `DB_DATABASE`, `DB_USER`, `DB_PASSWORD`)."
    },
    "expandDatabaseUrlPrefix": {
      "type": "string",
      "description": "Prefix applied to the expanded `DB_*` keys (e.g. `\"PG_\"`)."
    },
    "secretPrefix": {
      "type": "string",
      "description": "Prefix added to all sealed secret key names."
    },
    "secretMapping": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "description": "Rename specific secret keys in the sealed Secret. Takes precedence over `secretPrefix`. Map of `originalKey: newKey`."
    },
    "migrate": {
      "type": "object",
      "properties": {
        "migrationsFolder": {
          "type": "string",
          "description": "Drizzle migrations folder relative to repo root. Auto-detected by default."
        },
        "secretName": {
          "type": "string",
          "description": "CNPG secret name override. Default: `<fullnameOverride>-db-app`."
        }
      },
      "additionalProperties": false,
      "description": "Database migration settings (run as a hook before the app starts)."
    },
    "review": {
      "type": "object",
      "properties": {
        "baseDomain": {
          "type": "string",
          "description": "Base domain for review-app ingress (e.g. `review.nbrx.com`)."
        },
        "clusterIssuer": {
          "type": "string",
          "description": "cert-manager ClusterIssuer for review-app TLS. Default: `letsencrypt-dns01`."
        },
        "database": {
          "type": "object",
          "properties": {
            "imageName": {
              "type": "string"
            },
            "instances": {
              "type": "number"
            },
            "size": {
              "type": "string"
            },
            "resources": {
              "type": "object",
              "properties": {
                "requests": {
                  "type": "object",
                  "properties": {
                    "cpu": {
                      "type": "string"
                    },
                    "memory": {
                      "type": "string"
                    }
                  },
                  "additionalProperties": false
                },
                "limits": {
                  "type": "object",
                  "properties": {
                    "cpu": {
                      "type": "string"
                    },
                    "memory": {
                      "type": "string"
                    }
                  },
                  "additionalProperties": false
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false,
          "description": "CNPG database config for the shared review cluster."
        }
      },
      "additionalProperties": false,
      "description": "Review-app settings (ephemeral per-PR environments)."
    },
    "values": {
      "type": "object",
      "properties": {
        "replicaCount": {
          "type": "number",
          "description": "Number of pod replicas. Ignored when `autoscaling.enabled` is true.",
          "default": 1
        },
        "image": {
          "type": "object",
          "properties": {
            "repository": {
              "type": "string",
              "description": "GHCR image repository, e.g. \"ghcr.io/nbrx-ag/siteops\"."
            },
            "tag": {
              "type": "string",
              "description": "Image tag.",
              "default": "latest"
            },
            "pullPolicy": {
              "type": "string",
              "enum": [
                "Always",
                "IfNotPresent",
                "Never"
              ],
              "description": "Image pull policy.",
              "default": "IfNotPresent"
            }
          },
          "additionalProperties": false,
          "description": "Container image. `repository`/`tag` are normally set by the deploy CLI."
        },
        "imagePullSecrets": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string"
              }
            },
            "required": [
              "name"
            ],
            "additionalProperties": false
          },
          "description": "Image pull secrets referenced by the pod.",
          "default": [
            {
              "name": "nbrx-ghcr"
            }
          ]
        },
        "nameOverride": {
          "type": "string",
          "description": "Override the chart name portion of resource names."
        },
        "fullnameOverride": {
          "type": "string",
          "description": "Override the full resource name base (app name). Set by the deploy CLI."
        },
        "serviceAccount": {
          "type": "object",
          "properties": {
            "create": {
              "type": "boolean",
              "default": false
            },
            "name": {
              "type": "string",
              "default": ""
            },
            "annotations": {
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "default": {}
            }
          },
          "additionalProperties": false
        },
        "containerPort": {
          "type": "number",
          "description": "Port the application container listens on.",
          "default": 3000
        },
        "service": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "default": true
            },
            "type": {
              "type": "string",
              "enum": [
                "ClusterIP",
                "NodePort",
                "LoadBalancer"
              ],
              "default": "ClusterIP"
            },
            "port": {
              "type": "number",
              "default": 3000
            },
            "extraPorts": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": {}
              },
              "default": []
            }
          },
          "additionalProperties": false
        },
        "ingress": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "default": true
            },
            "className": {
              "type": "string",
              "default": "nginx"
            },
            "annotations": {
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "default": {}
            },
            "hosts": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "host": {
                    "type": "string"
                  },
                  "clusterIssuer": {
                    "type": "string"
                  }
                },
                "required": [
                  "host"
                ],
                "additionalProperties": false
              },
              "description": "Hostnames to expose. Each host may override the cert-manager issuer.",
              "default": []
            },
            "path": {
              "type": "string",
              "default": "/"
            },
            "pathType": {
              "type": "string",
              "enum": [
                "Prefix",
                "Exact",
                "ImplementationSpecific"
              ],
              "default": "Prefix"
            },
            "clusterIssuer": {
              "type": "string",
              "default": "letsencrypt-dns01"
            },
            "tls": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true
                },
                "secretName": {
                  "type": "string",
                  "default": ""
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "resources": {
          "type": "object",
          "properties": {
            "requests": {
              "type": "object",
              "properties": {
                "cpu": {
                  "type": "string",
                  "default": "100m"
                },
                "memory": {
                  "type": "string",
                  "default": "128Mi"
                }
              },
              "additionalProperties": false
            },
            "limits": {
              "type": "object",
              "properties": {
                "cpu": {
                  "type": "string",
                  "default": "300m"
                },
                "memory": {
                  "type": "string",
                  "default": "256Mi"
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "probes": {
          "type": "object",
          "properties": {
            "startup": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true
                },
                "path": {
                  "type": "string",
                  "description": "HTTP path probed on the container port.",
                  "default": "/healthz"
                },
                "initialDelaySeconds": {
                  "type": "number",
                  "default": 0
                },
                "periodSeconds": {
                  "type": "number",
                  "default": 2
                },
                "timeoutSeconds": {
                  "type": "number"
                },
                "failureThreshold": {
                  "type": "number",
                  "default": 15
                }
              },
              "additionalProperties": false
            },
            "readiness": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true
                },
                "path": {
                  "type": "string",
                  "description": "HTTP path probed on the container port.",
                  "default": "/readyz"
                },
                "initialDelaySeconds": {
                  "type": "number",
                  "default": 0
                },
                "periodSeconds": {
                  "type": "number",
                  "default": 3
                },
                "timeoutSeconds": {
                  "type": "number",
                  "default": 1
                },
                "failureThreshold": {
                  "type": "number",
                  "default": 3
                }
              },
              "additionalProperties": false
            },
            "liveness": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true
                },
                "path": {
                  "type": "string",
                  "description": "HTTP path probed on the container port.",
                  "default": "/livez"
                },
                "initialDelaySeconds": {
                  "type": "number",
                  "default": 5
                },
                "periodSeconds": {
                  "type": "number",
                  "default": 10
                },
                "timeoutSeconds": {
                  "type": "number",
                  "default": 1
                },
                "failureThreshold": {
                  "type": "number",
                  "default": 3
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "config": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Environment variables exposed via a ConfigMap.",
          "default": {
            "LOG_FORMAT": "json"
          }
        },
        "secretRefs": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string"
              },
              "optional": {
                "type": "boolean"
              }
            },
            "required": [
              "name"
            ],
            "additionalProperties": false
          },
          "description": "References to existing Secrets injected as envFrom."
        },
        "extraEnv": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          },
          "description": "Additional env vars in Kubernetes EnvVar format (supports valueFrom)."
        },
        "extraEnvFrom": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          }
        },
        "extraVolumes": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          }
        },
        "extraVolumeMounts": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          }
        },
        "extraLabels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "extraAnnotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "extraContainers": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          }
        },
        "extraInitContainers": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          }
        },
        "extraManifests": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          },
          "description": "Arbitrary extra manifests rendered as-is."
        },
        "customResources": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": {}
          },
          "description": "Arbitrary extra custom resources rendered as-is."
        },
        "database": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Provision an in-cluster CNPG PostgreSQL cluster.",
              "default": false
            },
            "imageName": {
              "type": "string",
              "default": "ghcr.io/cloudnative-pg/postgresql:17.4"
            },
            "instances": {
              "type": "number",
              "description": "Number of PostgreSQL instances. 1 = standalone, 2+ = HA replication.",
              "default": 1
            },
            "enablePDB": {
              "type": "boolean",
              "description": "Manage CNPG PodDisruptionBudgets. `true` (default) protects the primary from voluntary eviction. Set `false` to create NO PDB at all — the node hosting the DB can then be drained/consolidated freely at the cost of a brief restart (no switchover). Advisable for uncritical dev/staging DBs.",
              "default": true
            },
            "size": {
              "type": "string",
              "default": "5Gi"
            },
            "dbName": {
              "type": "string",
              "default": "app"
            },
            "owner": {
              "type": "string",
              "default": "app"
            },
            "expose": {
              "type": "boolean",
              "description": "Expose the database externally via Gateway API TLSRoute on port 5432.",
              "default": false
            },
            "hostname": {
              "type": "string",
              "description": "External hostname for DB access. Defaults to `db.<first ingress host>`.",
              "default": ""
            },
            "resources": {
              "type": "object",
              "properties": {
                "requests": {
                  "type": "object",
                  "properties": {
                    "cpu": {
                      "type": "string",
                      "default": "100m"
                    },
                    "memory": {
                      "type": "string",
                      "default": "256Mi"
                    }
                  },
                  "additionalProperties": false
                },
                "limits": {
                  "type": "object",
                  "properties": {
                    "cpu": {
                      "type": "string",
                      "default": "1"
                    },
                    "memory": {
                      "type": "string",
                      "default": "512Mi"
                    }
                  },
                  "additionalProperties": false
                }
              },
              "additionalProperties": false
            },
            "postgresql": {
              "type": "object",
              "properties": {
                "parameters": {
                  "type": "object",
                  "additionalProperties": {
                    "type": "string"
                  },
                  "description": "PostgreSQL GUCs merged into `spec.postgresql.parameters`, e.g. `{ log_min_duration_statement: \"1000\" }`. Values must be strings. CNPG-managed parameters (WAL, replication, logging destination) are enforced by the operator and cannot be overridden.",
                  "default": {}
                },
                "sharedPreloadLibraries": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "description": "Libraries preloaded at server start, e.g. `[\"pg_stat_statements\"]`. CNPG's managed-extensions feature creates/updates the matching extension automatically. Requires a rolling restart of the instances.",
                  "default": []
                }
              },
              "additionalProperties": false,
              "description": "PostgreSQL server configuration passed straight through to the CNPG `Cluster.spec.postgresql` block. Use it to tune the engine per app (slow-query logging, planner settings, extension preloading) without touching cluster-iac.\n\nChanging these triggers a CNPG config reload; parameters that require a restart (e.g. `shared_preload_libraries`) cause a rolling restart."
            },
            "backup": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "description": "Enable continuous WAL archiving + scheduled base backups (PITR).",
                  "default": false
                },
                "schedule": {
                  "type": "string",
                  "description": "Cron schedule (6-field: sec min hour dom mon dow).",
                  "default": "0 0 2 * * *"
                },
                "destinationPath": {
                  "type": "string",
                  "description": "S3 destination, e.g. \"s3://my-bucket/my-app-prod\". Required when enabled.",
                  "default": ""
                },
                "endpointURL": {
                  "type": "string",
                  "description": "S3-compatible endpoint. Empty = AWS S3.",
                  "default": ""
                },
                "retentionPolicy": {
                  "type": "string",
                  "default": "14d"
                },
                "immediate": {
                  "type": "boolean",
                  "default": true
                },
                "compression": {
                  "type": "string",
                  "enum": [
                    "gzip",
                    "bzip2",
                    "snappy"
                  ],
                  "default": "gzip"
                },
                "s3Credentials": {
                  "type": "object",
                  "properties": {
                    "secretName": {
                      "type": "string",
                      "default": "app-secrets"
                    },
                    "accessKeyIdKey": {
                      "type": "string",
                      "default": "BACKUP_S3_ACCESS_KEY_ID"
                    },
                    "secretAccessKeyKey": {
                      "type": "string",
                      "default": "BACKUP_S3_SECRET_ACCESS_KEY"
                    }
                  },
                  "additionalProperties": false
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "cronTasks": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string"
              },
              "schedule": {
                "type": "string"
              },
              "action": {
                "type": "string"
              }
            },
            "required": [
              "name",
              "schedule",
              "action"
            ],
            "additionalProperties": false
          },
          "description": "Scheduled HTTP tasks executed via hurl CronJobs."
        },
        "autoscaling": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "default": false
            },
            "minReplicas": {
              "type": "number",
              "default": 2
            },
            "maxReplicas": {
              "type": "number",
              "default": 5
            },
            "targetCPUUtilizationPercentage": {
              "type": "number",
              "default": 80
            }
          },
          "additionalProperties": false
        },
        "strategy": {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "enum": [
                "RollingUpdate",
                "Recreate"
              ],
              "default": "RollingUpdate"
            },
            "rollingUpdate": {
              "type": "object",
              "properties": {
                "maxSurge": {
                  "type": [
                    "string",
                    "number"
                  ],
                  "default": "100%"
                },
                "maxUnavailable": {
                  "type": [
                    "string",
                    "number"
                  ],
                  "default": 0
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "podDefaults": {
          "type": "object",
          "properties": {
            "nodeSelector": {
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "default": {
                "cfke.io/region": "europe",
                "cfke.io/subregion": "central"
              }
            },
            "tolerations": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": {}
              },
              "default": []
            },
            "affinity": {
              "type": "object",
              "additionalProperties": {},
              "default": {}
            },
            "spreadAcrossNodes": {
              "type": "boolean",
              "description": "Spread replicas across nodes via pod anti-affinity.",
              "default": false
            }
          },
          "additionalProperties": false
        },
        "monitoring": {
          "type": "object",
          "properties": {
            "probe": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": false
                },
                "interval": {
                  "type": "string",
                  "default": "30s"
                },
                "scrapeTimeout": {
                  "type": "string",
                  "default": "10s"
                },
                "module": {
                  "type": "string",
                  "default": "http_2xx"
                },
                "path": {
                  "type": "string",
                  "description": "Probe path. Defaults to `probes.liveness.path`.",
                  "default": ""
                },
                "prober": {
                  "type": "object",
                  "properties": {
                    "url": {
                      "type": "string",
                      "default": "blackbox-exporter.monitoring.svc:9115"
                    }
                  },
                  "additionalProperties": false
                }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false,
      "description": "Helm-style values rendered by the webapp chart."
    }
  },
  "additionalProperties": false,
  "description": "Deployment manifest for the nbrx GitOps cluster (webapp chart).\n\nFull cluster context — deploy pipeline, CNPG databases, Cloudfleet node model, debugging playbook: https://cluster.nbrx.com/AGENTS.md\nAI agents working in this repo should read that document before changing .cluster/app.yaml or debugging a deployment.",
  "definitions": {},
  "title": "webapp app.yaml",
  "$comment": "Cluster context for AI agents: https://cluster.nbrx.com/AGENTS.md"
}