values.yaml

# Default values for lago-pdf.

# -- @ignore
global:
  lago:
    # -- Rails environment (`production`, `staging`, `development`)
    # @section -- Lago
    env: "production"
    # -- Override the application Docker image tag (defaults to Chart appVersion)
    # @section -- Lago
    version:
    # -- Lago Premium license key
    # @section -- Lago
    license: ""
    # -- Enable Lago Cloud mode
    # @section -- Lago
    cloud: false
    # -- Enable PDF generation support
    # @section -- Lago
    pdfGeneration: false

  sidekiq:
    # -- Enable Sidekiq Pro (requires valid license)
    # @section -- Sidekiq
    pro: false
    queues:
      # -- Enable the analytics background queue
      # @section -- Sidekiq
      analytics: false
      # -- Enable the billing background queue
      # @section -- Sidekiq
      billing: false
      # -- Enable the clock background queue
      # @section -- Sidekiq
      clock: false
      # -- Enable the events background queue
      # @section -- Sidekiq
      events: false
      # -- Enable the webhook background queue
      # @section -- Sidekiq
      webhook: false
      # -- Enable the PDF background queue
      # @section -- Sidekiq
      pdf: false

  config:
    # -- Name of an existing Secret for shared configuration (bypasses auto-generated secret)
    # @section -- Config
    secret: ""
    # -- Name of an existing ConfigMap for shared configuration (bypasses auto-generated configmap)
    # @section -- Config
    configmap: ""

  urls:
    # -- Public URL of the Lago API
    # @section -- URLs
    api: ""
    # -- Public URL of the Lago frontend
    # @section -- URLs
    front: ""
    # -- Internal URL of the PDF service (Gotenberg)
    # @section -- URLs
    pdf: "lago-pdf"

  database:
    # -- PostgreSQL connection URI
    # @section -- Database
    uri: ""
    # -- Database connection pool size
    # @section -- Database
    pool: 20

  encryption:
    # -- Primary encryption key (`openssl rand -hex 16`)
    # @section -- Encryption
    key: ""
    # -- Key derivation salt (`openssl rand -hex 16`)
    # @section -- Encryption
    salt: ""

  signing:
    # -- HMAC signing key used by webhooks and message verifier (HS256)
    # @section -- Signing
    hmac: ""
    # -- RSA private key for webhook signatures (RS256), base64-encoded
    # @section -- Signing
    rsa: ""

  redis:
    # -- Redis URI for Sidekiq job queue
    # @section -- Redis
    uri: ""
    # -- Redis password (appended to URI if set)
    # @section -- Redis
    password: ""

  redisCache:
    # -- Redis URI for Rails cache
    # @section -- Redis
    uri: ""
    # -- Redis cache password
    # @section -- Redis
    password: ""

  redisStore:
    # -- Redis URI for ActionCable / general store
    # @section -- Redis
    uri: ""
    # -- Redis store password
    # @section -- Redis
    password: ""

  # -- Segment write key for analytics
  # @section -- Observability
  segmentWriteKey: ""

  nango:
    # -- Nango secret key for OAuth integrations
    # @section -- Nango
    secretKey: ""

  s3:
    # -- Enable S3-compatible object storage
    # @section -- S3
    enabled: false
    # -- S3 access key ID
    # @section -- S3
    accessKeyId: ""
    # -- S3 secret access key
    # @section -- S3
    secretAccessKey: ""
    # -- S3 bucket name
    # @section -- S3
    bucket: ""
    # -- S3 region
    # @section -- S3
    region: "us-east-1"
    # -- S3 custom endpoint (for MinIO, etc.)
    # @section -- S3
    endpoint: ""
    # -- (bool) Use path-style addressing instead of virtual-hosted-style
    # @section -- S3
    pathStyle:

  smtp:
    # -- Enable SMTP for outbound email
    # @section -- SMTP
    enabled: false
    # -- SMTP username
    # @section -- SMTP
    username: ""
    # -- SMTP password
    # @section -- SMTP
    password: ""
    # -- Sender email address
    # @section -- SMTP
    from: ""
    # -- SMTP port
    # @section -- SMTP
    port: 25
    # -- SMTP server address
    # @section -- SMTP
    address: ""

  google:
    # -- Enable Google OAuth
    # @section -- Google
    enabled: false
    # -- Google OAuth client ID
    # @section -- Google
    clientId:
    # -- Google OAuth client secret
    # @section -- Google
    clientSecret:

  gocardless:
    # -- Enable GoCardless integration
    # @section -- GoCardless
    enabled: false
    # -- GoCardless client ID
    # @section -- GoCardless
    clientId:
    # -- GoCardless client secret
    # @section -- GoCardless
    clientSecret:
    # -- GoCardless API proxy URL
    # @section -- GoCardless
    proxy:

  mcp:
    # -- Enable MCP (Model Context Protocol) integration
    # @section -- MCP
    enabled: false
    # -- MCP client ID
    # @section -- MCP
    clientId:
    # -- MCP client secret
    # @section -- MCP
    clientSecret:
    # -- MCP endpoint URL
    # @section -- MCP
    endpoint:

  data:
    # -- Enable Lago Data analytics
    # @section -- Data
    enabled: false
    # -- Lago Data API token
    # @section -- Data
    token:
    # -- Lago Data API endpoint
    # @section -- Data
    endpoint:

  streaming_ingestion:
    # -- Enable streaming ingestion (ClickHouse + Kafka)
    # @section -- Streaming Ingestion
    enabled: false
    # -- Name of an existing ConfigMap for streaming config
    # @section -- Streaming Ingestion
    configmap: ""
    # -- Name of an existing Secret for streaming credentials
    # @section -- Streaming Ingestion
    secret: ""

    clickhouse:
      # -- ClickHouse username (not required when using an external secret)
      # @section -- Streaming Ingestion / ClickHouse
      username: ""
      # -- ClickHouse password (not required when using an external secret)
      # @section -- Streaming Ingestion / ClickHouse
      password: ""
      # -- ClickHouse native protocol port
      # @section -- Streaming Ingestion / ClickHouse
      port: 9000
      # -- ClickHouse server address
      # @section -- Streaming Ingestion / ClickHouse
      address: clickhouse
      # -- Enable TLS for ClickHouse connections
      # @section -- Streaming Ingestion / ClickHouse
      tls: false
      # -- ClickHouse database name
      # @section -- Streaming Ingestion / ClickHouse
      database: default

    kafka:
      # -- Kafka username (not required when using an external secret)
      # @section -- Streaming Ingestion / Kafka
      username: ""
      # -- Kafka password (not required when using an external secret)
      # @section -- Streaming Ingestion / Kafka
      password: ""
      # -- Enable TLS for Kafka connections
      # @section -- Streaming Ingestion / Kafka
      tls: false
      # -- Kafka SASL mechanism (`SCRAM-SHA-512`, `SCRAM-SHA-256`)
      # @section -- Streaming Ingestion / Kafka
      saslMechanisms:
      # -- Kafka consumer group name
      # @section -- Streaming Ingestion / Kafka
      consumerGroup: events_consumer
      # -- List of Kafka bootstrap servers
      # @default -- `[]`
      # @section -- Streaming Ingestion / Kafka
      bootstrapServers: []
      topics:
        # -- Kafka topic for charged-in-advance events
        # @section -- Streaming Ingestion / Kafka
        eventsChargedInAdvance: events_charged_in_advance
        # -- Kafka topic for dead-letter events
        # @section -- Streaming Ingestion / Kafka
        eventsDeadLetter: events_dead_letter
        # -- Kafka topic for enriched events
        # @section -- Streaming Ingestion / Kafka
        eventsEnriched: events_enriched
        # -- Kafka topic for expanded enriched events
        # @section -- Streaming Ingestion / Kafka
        eventsEnrichedExpanded: events_enriched_expanded
        # -- Kafka topic for raw events
        # @section -- Streaming Ingestion / Kafka
        eventsRaw: events_raw
        # -- Kafka topic for activity logs
        # @section -- Streaming Ingestion / Kafka
        activityLogs: activity_logs
        # -- Kafka topic for API logs
        # @section -- Streaming Ingestion / Kafka
        apiLogs: api_logs
        # -- Kafka topic for security logs
        # @section -- Streaming Ingestion / Kafka
        securityLogs: securityLogs

# -- Local lago-config subchart settings
# @section -- PDF Config
config:
  # -- Deploy the lago-config subchart
  # @section -- PDF Config
  enabled: true
  # -- Override the config subchart release name
  # @section -- PDF Config
  nameOverride: lago-pdf-config

# @section -- PDF Worker
worker:
  # -- Deploy the PDF worker
  # @section -- PDF Worker
  enabled: true
  # -- Override the worker subchart release name
  # @section -- PDF Worker
  nameOverride: lago-pdf-worker
  config:
    # -- Disable nested config (uses parent config)
    # @section -- PDF Worker
    enabled: false
    # -- Config subchart name override
    # @section -- PDF Worker
    nameOverride: lago-pdf-config

  service:
    # -- Disable service for the worker (no inbound traffic)
    # @section -- PDF Worker
    enabled: false

  # -- Liveness probe (disabled for worker)
  # @section -- PDF Worker
  livenessProbe:
    enabled: false
  # -- Readiness probe (disabled for worker)
  # @section -- PDF Worker
  readinessProbe:
    enabled: false

  container:
    # -- Worker entrypoint command
    # @section -- PDF Worker
    command: ["./scripts/start.worker.sh"]
    # -- Worker container ports (none needed)
    # @section -- PDF Worker
    ports: []

# @section -- Gotenberg
gotenberg:
  image:
    # -- Gotenberg image repository
    # @section -- Gotenberg
    repository: ghcr.io/getlago/gotenberg
    # -- Override the Gotenberg image tag
    # @section -- Gotenberg
    tag:
    # -- Image pull policy
    # @section -- Gotenberg
    pullPolicy: IfNotPresent

  # -- Number of Gotenberg replicas (ignored when autoscaling is enabled)
  # @section -- Gotenberg
  replicaCount: 1

  container:
    # -- Override the container name
    # @section -- Gotenberg
    name: ""
    # -- Container entrypoint command
    # @section -- Gotenberg
    command: []
    # -- Container command arguments. These are the best-performing
    # values we have found in production: restart Chromium every 100
    # jobs to avoid zombie processes, cap the queue at 20, disable JS
    # in invoice HTML, ignore certificate errors on the Chromium
    # fetcher, disable LibreOffice routes we do not use, and cap the
    # API timeout at 30s. `--api-disable-health-check-logging` was
    # renamed to `--api-disable-health-check-route-telemetry` in
    # Gotenberg 8.32 and defaults to `true`, so it is intentionally
    # not set here.
    # @section -- Gotenberg
    args:
      - gotenberg
      - --libreoffice-disable-routes=true
      - --chromium-ignore-certificate-errors=true
      - --chromium-disable-javascript=true
      - --api-timeout=30s
      - --chromium-max-queue-size=20
      - --chromium-restart-after=100
    ports:
      # -- HTTP container port
      # @section -- Gotenberg
      http: 3000

  service:
    # -- Create a Service for Gotenberg
    # @section -- Gotenberg
    enabled: true
    # -- Service type
    # @section -- Gotenberg
    type: ClusterIP
    # -- Service port
    # @section -- Gotenberg
    port: 80

  serviceAccount:
    # -- Create a ServiceAccount
    # @section -- Gotenberg
    create: true
    # -- Automount the ServiceAccount API credentials
    # @section -- Gotenberg
    automount: true
    # -- Annotations to add to the ServiceAccount
    # @section -- Gotenberg
    annotations: {}
    # -- ServiceAccount name (generated from fullname if not set)
    # @section -- Gotenberg
    name: ""

  # -- Additional pod annotations
  # @section -- Gotenberg
  podAnnotations: {}
  # -- Additional pod labels
  # @section -- Gotenberg
  podLabels: {}

  # -- Pod-level security context
  # @section -- Gotenberg
  podSecurityContext: {}

  # -- Container-level security context
  # @section -- Gotenberg
  securityContext: {}

  # -- Extra environment variables (map format, deep-mergeable)
  # @section -- Gotenberg
  extraEnv: {}

  # -- Extra envFrom sources
  # @default -- `[]` (See [values.yaml])
  # @section -- Gotenberg
  extraEnvFrom: []

  # -- Liveness probe configuration
  # @default -- See [values.yaml](./values.yaml#L424)
  # @section -- Gotenberg
  livenessProbe:
    httpGet:
      path: /health
      port: http
    initialDelaySeconds: 10
    periodSeconds: 30

  # -- Readiness probe configuration
  # @default -- See [values.yaml](./values.yaml#L434)
  # @section -- Gotenberg
  readinessProbe:
    httpGet:
      path: /health
      port: http
    initialDelaySeconds: 10
    periodSeconds: 3

  autoscaling:
    # -- Enable Horizontal Pod Autoscaler
    # @section -- Gotenberg
    enabled: false
    # -- Set to true when using an external autoscaler (e.g. KEDA) to skip built-in HPA
    # @section -- Gotenberg
    external: false
    # -- Minimum replicas
    # @section -- Gotenberg
    minReplicas: 1
    # -- Maximum replicas
    # @section -- Gotenberg
    maxReplicas: 100
    # -- Target CPU utilization percentage
    # @section -- Gotenberg
    targetCPUUtilizationPercentage: 80

  # -- Resource requests and limits
  # @section -- Gotenberg
  resources: {}

  # -- Additional volumes
  # @section -- Gotenberg
  volumes: []

  # -- Additional volume mounts
  # @section -- Gotenberg
  volumeMounts: []

  # -- Node selector constraints
  # @section -- Gotenberg
  nodeSelector: {}

  # -- Pod tolerations
  # @section -- Gotenberg
  tolerations: []

  # -- Pod affinity rules
  # @section -- Gotenberg
  affinity: {}

  # -- Pod topology spread constraints
  # @section -- Gotenberg
  topologySpreadConstraints: []

  # -- Image pull secrets for private registries
  # @section -- Gotenberg
  imagePullSecrets: []
  # -- Override the Gotenberg chart name
  # @section -- Gotenberg
  nameOverride: ""
  # -- Override the Gotenberg full release name
  # @section -- Gotenberg
  fullnameOverride: ""

# -- Deployment metadata annotations (e.g. Stakater Reloader)
# @section -- Deployment
annotations: {}

# -- Override the chart name
# @section -- Deployment
nameOverride: ""
# -- Override the full release name
# @section -- Deployment
fullnameOverride: ""

# -- Array of extra K8s manifests to deploy
# @section -- Extra Objects
extraObjects: []