values.yaml

# Default values for lago-config.

global:
  lago:
    # -- Override the application Docker image tag (defaults to Chart appVersion)
    # @section -- Lago
    version: ""
    # -- Rails environment (`production`, `staging`, `development`)
    # @section -- Lago
    env: "production"
    # -- Lago Premium license key
    # @section -- Lago
    license: ""
    # -- Enable self-service signup
    # @section -- Lago
    signup: false
    # -- Enable Lago Cloud mode
    # @section -- Lago
    cloud: false
    # -- Enable PDF generation support
    # @section -- Lago
    pdfGeneration: false

  sidekiq:
    # -- Enable Sidekiq Pro (requires valid license)
    # @section -- Sidekiq
    pro: false
    queues:
      # -- Enable the analytics background queue
      # @section -- Sidekiq
      analytics: false
      # -- Enable the billing background queue
      # @section -- Sidekiq
      billing: false
      # -- Enable the clock background queue
      # @section -- Sidekiq
      clock: false
      # -- Enable the events background queue
      # @section -- Sidekiq
      events: false
      # -- Enable the webhook background queue
      # @section -- Sidekiq
      webhook: false
      # -- Enable the PDF background queue
      # @section -- Sidekiq
      pdf: false
      # -- Dedicated worker queue toggle (dict, unlike other queue flags).
      # See charts/lago/values.yaml for the full contract.
      # @section -- Sidekiq
      dedicated:
        # -- Gate for the dedicated worker: writes sidekiq.dedicated.*
        # keys to the shared ConfigMap when true.
        # @section -- Sidekiq
        enabled: false
        # -- Comma-separated tenant org UUIDs (LAGO_DEDICATED_WORKER_ORG_IDS).
        # @section -- Sidekiq
        orgIds: ""
        # -- Optional refresh cadence (LAGO_DEDICATED_REFRESH_INTERVAL_SECONDS).
        # @section -- Sidekiq
        refreshIntervalSeconds: ""

  config:
    # -- Name of an existing ConfigMap for shared configuration (bypasses auto-generated configmap)
    # @section -- Config
    configmap:
    # -- Name of an existing Secret for shared configuration (bypasses auto-generated secret)
    # @section -- Config
    secret:

  urls:
    # -- Public URL of the Lago API
    # @section -- URLs
    api: ""
    # -- Public URL of the Lago frontend
    # @section -- URLs
    front: ""
    # -- Internal URL of the PDF service (Gotenberg)
    # @section -- URLs
    pdf: "lago-pdf"

  database:
    # -- PostgreSQL connection URI
    # @section -- Database
    uri: ""
    # -- Database connection pool size
    # @section -- Database
    pool: 20
    # -- (bool) Enable ActiveRecord prepared statements. Leave unset to use the
    # Rails default (`true`); set to `false` when running behind a connection
    # pooler that can't multiplex sessions issuing prepared statements. Renders
    # the `DATABASE_PREPARED_STATEMENTS` env var on Rails pods only when
    # explicitly set.
    # @section -- Database
    preparedStatement:

  encryption:
    # -- Primary encryption key (`openssl rand -hex 16`)
    # @section -- Encryption
    key: ""
    # -- Key derivation salt (`openssl rand -hex 16`)
    # @section -- Encryption
    salt: ""

  signing:
    # -- HMAC signing key used by webhooks and message verifier (HS256)
    # @section -- Signing
    hmac: ""
    # -- RSA private key for webhook signatures (RS256), base64-encoded
    # @section -- Signing
    rsa: ""

  redis:
    # -- Redis URI for Sidekiq job queue
    # @section -- Redis
    uri: ""
    # -- Redis password (appended to URI if set)
    # @section -- Redis
    password: ""

  redisCache:
    # -- Redis URI for Rails cache
    # @section -- Redis
    uri: ""
    # -- Redis cache password
    # @section -- Redis
    password: ""

  redisStore:
    # -- Redis URI for ActionCable / general store
    # @section -- Redis
    uri: ""
    # -- Redis store password
    # @section -- Redis
    password: ""

  # One DSN per Sentry project. Components that report to the same Sentry
  # project share a key so fingerprints, traces and release tracking line
  # up. Add a new entry when a component is run as its own Sentry project
  # (different SDK or operationally separate service).
  sentry:
    # -- Sentry environment name (e.g. "production", "staging"), injected as SENTRY_ENVIRONMENT into every component that reports to Sentry
    # @section -- Observability
    environment: ""
    dsn:
      # -- Sentry DSN for the Ruby backend / Sidekiq workers (lago-rails)
      # @section -- Observability
      back: ""
      # -- Sentry DSN for the events processor worker (separate Sentry project from `back`)
      # @section -- Observability
      events: ""
      # -- Sentry DSN for the JavaScript frontend (lago-front)
      # @section -- Observability
      front: ""
      # Future component DSNs plug in as additional map entries:
      # data: ""

  # -- Segment write key for analytics
  # @section -- Observability
  segmentWriteKey: ""

  nango:
    # -- Nango secret key for OAuth integrations
    # @section -- Nango
    secretKey: ""
    # -- Nango public key for frontend OAuth flows
    # @section -- Nango
    publicKey: ""

  s3:
    # -- Enable S3-compatible object storage
    # @section -- S3
    enabled: false
    # -- S3 access key ID. Leave empty to authenticate via IRSA / EKS Pod Identity.
    # @section -- S3
    accessKeyId: ""
    # -- S3 secret access key. Leave empty to authenticate via IRSA / EKS Pod Identity.
    # @section -- S3
    secretAccessKey: ""
    # -- S3 bucket name
    # @section -- S3
    bucket: ""
    # -- S3 region
    # @section -- S3
    region: ""
    # -- S3 custom endpoint (for MinIO, etc.)
    # @section -- S3
    endpoint: ""
    # -- (bool) Use path-style addressing instead of virtual-hosted-style
    # @section -- S3
    pathStyle:

  smtp:
    # -- Enable SMTP for outbound email
    # @section -- SMTP
    enabled: false
    # -- SMTP username
    # @section -- SMTP
    username: ""
    # -- SMTP password
    # @section -- SMTP
    password: ""
    # -- Sender email address
    # @section -- SMTP
    from: ""
    # -- SMTP port
    # @section -- SMTP
    port: 25
    # -- SMTP server address
    # @section -- SMTP
    address: ""

  google:
    # -- Enable Google OAuth
    # @section -- Google
    enabled: false
    # -- Google OAuth client ID
    # @section -- Google
    clientId:
    # -- Google OAuth client secret
    # @section -- Google
    clientSecret:

  gocardless:
    # -- Enable GoCardless integration
    # @section -- GoCardless
    enabled: false
    # -- GoCardless client ID
    # @section -- GoCardless
    clientId:
    # -- GoCardless client secret
    # @section -- GoCardless
    clientSecret:
    # -- GoCardless API proxy URL
    # @section -- GoCardless
    proxy:

  mcp:
    # -- Enable MCP (Model Context Protocol) integration
    # @section -- MCP
    enabled: false
    # -- MCP client ID
    # @section -- MCP
    clientId:
    # -- MCP client secret
    # @section -- MCP
    clientSecret:
    # -- MCP endpoint URL
    # @section -- MCP
    endpoint:

  data:
    # -- Enable Lago Data analytics
    # @section -- Data
    enabled: false
    # -- Lago Data API token
    # @section -- Data
    token:
    # -- Lago Data API endpoint
    # @section -- Data
    endpoint:

  streaming_ingestion:
    # -- Enable streaming ingestion (ClickHouse + Kafka)
    # @section -- Streaming Ingestion
    enabled: false
    # -- Name of an existing ConfigMap for streaming config
    # @section -- Streaming Ingestion
    configmap: ""
    # -- Name of an existing Secret for streaming credentials
    # @section -- Streaming Ingestion
    secret: ""

    clickhouse:
      # -- ClickHouse username (not required when using an external secret)
      # @section -- Streaming Ingestion / ClickHouse
      username: ""
      # -- ClickHouse password (not required when using an external secret)
      # @section -- Streaming Ingestion / ClickHouse
      password: ""
      # -- ClickHouse native protocol port
      # @section -- Streaming Ingestion / ClickHouse
      port: 9000
      # -- ClickHouse server address
      # @section -- Streaming Ingestion / ClickHouse
      address: clickhouse
      # -- Enable TLS for ClickHouse connections
      # @section -- Streaming Ingestion / ClickHouse
      tls: false
      # -- ClickHouse database name
      # @section -- Streaming Ingestion / ClickHouse
      database: default
      # -- Enable in-Rails ClickHouse migrations (`LAGO_CLICKHOUSE_MIGRATIONS_ENABLED`).
      # Set to `false` when ClickHouse schema is managed out-of-band (dedicated
      # migration job, dbt, or a CI pipeline). Default `true` for back-compat
      # with earlier chart versions that hardcoded it.
      # @section -- Streaming Ingestion / ClickHouse
      migrationsEnabled: true
      # -- ClickHouse read-replica hostname, published as
      # `LAGO_CLICKHOUSE_HOST_READ_ONLY` in the streaming ConfigMap when
      # set. The umbrella lago chart's `analytics-worker` alias reads
      # this key via `optional: true` extraEnv to override
      # `LAGO_CLICKHOUSE_HOST` on that Deployment only. Username +
      # password are NOT split — CH Cloud data warehouses share a user
      # directory across all their compute services, so the primary
      # `LAGO_CLICKHOUSE_USERNAME` / `LAGO_CLICKHOUSE_PASSWORD` mounted
      # via `envFrom` authenticate against the replica too. Empty
      # string = no extra key is written.
      # @section -- Streaming Ingestion / ClickHouse
      hostReadOnly: ""

    kafka:
      # -- Kafka username (not required when using an external secret)
      # @section -- Streaming Ingestion / Kafka
      username: ""
      # -- Kafka password (not required when using an external secret)
      # @section -- Streaming Ingestion / Kafka
      password: ""
      # -- Enable TLS for Kafka connections
      # @section -- Streaming Ingestion / Kafka
      tls: false
      # -- Kafka SASL mechanism (`SCRAM-SHA-512`, `SCRAM-SHA-256`)
      # @section -- Streaming Ingestion / Kafka
      saslMechanisms:
      # -- Kafka Security Protocol (`SASL_SSL`)
      # @section -- Streaming Ingestion / Kafka
      securityProtocol:
      # -- Kafka consumer group name for the Rails events consumer
      # (`LAGO_KAFKA_CONSUMER_GROUP`). Published in the streaming
      # ConfigMap. Sub-charts that need a distinct group (e.g. the Go
      # events-processor) flip their own `useKafkaConsumerGroupEventsProcessor`
      # flag and read `consumerGroupEventsProcessor` (below) from the
      # same ConfigMap instead.
      # @section -- Streaming Ingestion / Kafka
      consumerGroup: events_consumer
      # -- Kafka consumer group for the Go events-processor worker,
      # published as `LAGO_KAFKA_CONSUMER_GROUP_EVENTS_PROCESSOR` in
      # the streaming ConfigMap when set. The
      # `lago-events-processor-worker` subchart's
      # `useKafkaConsumerGroupEventsProcessor` flag (defaulted on by
      # the umbrella lago chart) redirects that worker's
      # `LAGO_KAFKA_CONSUMER_GROUP` env at this key, so the processor
      # consumes in parallel with the Rails events consumer instead of
      # competing on the same group. Empty string = no extra key is
      # written.
      # @section -- Streaming Ingestion / Kafka
      consumerGroupEventsProcessor: ""
      # -- Kafka consumer group for the ClickHouse Kafka engine
      # (`LAGO_KAFKA_CLICKHOUSE_CONSUMER_GROUP`). Only relevant when
      # ClickHouse ingests directly from Kafka via its Kafka table
      # engine (staging/dev). Leave empty in production stacks that
      # rely on ClickPipes / dedicated processor workers — the
      # `LAGO_KAFKA_CLICKHOUSE_CONSUMER_GROUP` env var is omitted
      # from the streaming ConfigMap when this value is empty.
      # @section -- Streaming Ingestion / Kafka
      clickhouseConsumerGroup: ""
      # -- List of Kafka bootstrap servers
      # @default -- `[]`
      # @section -- Streaming Ingestion / Kafka
      bootstrapServers: []
      topics:
        # -- Kafka topic for charged-in-advance events
        # @section -- Streaming Ingestion / Kafka
        eventsChargedInAdvance: events_charged_in_advance
        # -- Kafka topic for dead-letter events
        # @section -- Streaming Ingestion / Kafka
        eventsDeadLetter: events_dead_letter
        # -- Kafka topic for enriched events
        # @section -- Streaming Ingestion / Kafka
        eventsEnriched: events_enriched
        # -- Kafka topic for expanded enriched events
        # @section -- Streaming Ingestion / Kafka
        eventsEnrichedExpanded: events_enriched_expanded
        # -- Kafka topic for raw events
        # @section -- Streaming Ingestion / Kafka
        eventsRaw: events_raw
        # -- Kafka topic for activity logs
        # @section -- Streaming Ingestion / Kafka
        activityLogs: activity_logs
        # -- Kafka topic for API logs
        # @section -- Streaming Ingestion / Kafka
        apiLogs: api_logs
        # -- Kafka topic for security logs
        # @section -- Streaming Ingestion / Kafka
        securityLogs: security_logs
        # -- Kafka topic for unprocessed events (dead-letter for pre-enrichment failures)
        # @section -- Streaming Ingestion / Kafka
        unprocessedEvents: unprocessed_events

configmap:
  # -- Create the ConfigMap (set to false when using an externally managed ConfigMap)
  # @section -- ConfigMap
  create: true
  # -- Override the ConfigMap name (generated from fullname if not set)
  # @section -- ConfigMap
  name: ""
  # -- Additional labels for the ConfigMap
  # @section -- ConfigMap
  labels: {}
  # -- Additional annotations for the ConfigMap
  # @section -- ConfigMap
  annotations: {}

secret:
  # -- Create the Secret for sensitive configuration
  # @section -- Secret
  create: true
  # -- Override the Secret name (generated from fullname if not set)
  # @section -- Secret
  name: ""
  # -- Additional labels for the Secret
  # @section -- Secret
  labels: {}
  # -- Additional annotations for the Secret
  # @section -- Secret
  annotations: {}

configmapStreaming:
  # -- Override the streaming ConfigMap name (generated from fullname if not set)
  # @section -- Streaming ConfigMap
  name: ""
  # -- Additional labels for the streaming ConfigMap
  # @section -- Streaming ConfigMap
  labels: {}
  # -- Additional annotations for the streaming ConfigMap
  # @section -- Streaming ConfigMap
  annotations: {}

secretStreaming:
  # -- Create the streaming Secret for sensitive streaming credentials
  # @section -- Streaming Secret
  create: true
  # -- Override the streaming Secret name (generated from fullname if not set)
  # @section -- Streaming Secret
  name: ""
  # -- Additional labels for the streaming Secret
  # @section -- Streaming Secret
  labels: {}
  # -- Additional annotations for the streaming Secret
  # @section -- Streaming Secret
  annotations: {}