chore: import upstream snapshot with attribution

helm/sim/examples/values-external-db.yaml

@@ -0,0 +1,187 @@
+# values-external-db.yaml
+#
+# When to use: production deployments that use a managed Postgres service
+# (AWS RDS, Azure Database for PostgreSQL, Google Cloud SQL, Neon, Supabase)
+# instead of the chart's in-cluster Postgres StatefulSet. The in-cluster
+# Postgres is disabled (postgresql.enabled=false).
+#
+# Prerequisites:
+#   - A reachable managed Postgres instance with pgvector extension available
+#   - DB credentials provisioned (user, password, database)
+#   - Network reachability from the cluster (peering, private link, or public
+#     endpoint with TLS)
+#
+# Install:
+#   helm install sim ./helm/sim \
+#     --namespace sim --create-namespace \
+#     --values ./helm/sim/examples/values-external-db.yaml \
+#     --set externalDatabase.host=your-db.example.com \
+#     --set externalDatabase.username=simstudio_user \
+#     --set externalDatabase.password="$DB_PASSWORD" \
+#     --set externalDatabase.database=simstudio_prod \
+#     --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+#     --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
+#     --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET"
+
+# Global configuration
+global:
+  imageRegistry: "ghcr.io"
+
+# Main application
+app:
+  enabled: true
+  replicaCount: 2
+  
+  resources:
+    limits:
+      memory: "4Gi"
+      cpu: "2000m"
+    requests:
+      memory: "2Gi"
+      cpu: "1000m"
+  
+  env:
+    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
+    BETTER_AUTH_URL: "https://simstudio.acme.com"
+    SOCKET_SERVER_URL: "https://simstudio-ws.acme.com"
+    NEXT_PUBLIC_SOCKET_URL: "https://simstudio-ws.acme.com"
+    
+    # Security settings (REQUIRED - replace with your own secure secrets)
+    # Generate using: openssl rand -hex 32
+    BETTER_AUTH_SECRET: ""  # Set via --set flag or external secret manager
+    ENCRYPTION_KEY: ""      # Set via --set flag or external secret manager
+    INTERNAL_API_SECRET: "" # Set via --set flag or external secret manager
+    CRON_SECRET: ""         # Set via --set flag or external secret manager
+
+    # Optional: API Key Encryption (RECOMMENDED for production)
+    # Generate 64-character hex string using: openssl rand -hex 32
+    API_ENCRYPTION_KEY: ""  # Optional but recommended - encrypts API keys at rest
+    
+    NODE_ENV: "production"
+    NEXT_TELEMETRY_DISABLED: "1"
+
+# Realtime service
+realtime:
+  enabled: true
+  replicaCount: 2
+  
+  resources:
+    limits:
+      memory: "4Gi"
+      cpu: "1000m"
+    requests:
+      memory: "2Gi"
+      cpu: "500m"
+  
+  env:
+    NEXT_PUBLIC_APP_URL: "https://simstudio.acme.com"
+    BETTER_AUTH_URL: "https://simstudio.acme.com"
+    BETTER_AUTH_SECRET: ""  # Must match main app secret - set via --set flag
+    ALLOWED_ORIGINS: "https://simstudio.acme.com"
+    NODE_ENV: "production"
+
+# Database migrations
+migrations:
+  enabled: true
+  
+  resources:
+    limits:
+      memory: "2Gi"
+      cpu: "1000m"
+    requests:
+      memory: "1Gi"
+      cpu: "500m"
+
+# Disable internal PostgreSQL
+postgresql:
+  enabled: false
+
+# Configure external database connection
+externalDatabase:
+  enabled: true
+  
+  # Database connection details (REQUIRED - configure for your external database)
+  host: ""                    # Database hostname (e.g., "postgres.acme.com" or RDS endpoint)
+  port: 5432
+  username: ""                # Database username (e.g., "simstudio_user")
+  password: ""                # Database password - set via --set flag or external secret
+  database: ""                # Database name (e.g., "simstudio_production")
+  
+  # SSL mode for database connections (recommended: 'require' for production)
+  sslMode: "require"          # Options: disable, allow, prefer, require, verify-ca, verify-full
+
+# Ollama (optional for AI models)
+ollama:
+  enabled: false
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: nginx
+  
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  
+  app:
+    host: simstudio.acme.com
+    paths:
+      - path: /
+        pathType: Prefix
+  
+  realtime:
+    host: simstudio-ws.acme.com
+    paths:
+      - path: /
+        pathType: Prefix
+  
+  tls:
+    enabled: true
+    secretName: simstudio-tls-secret
+
+# Production-ready features (autoscaling, monitoring, etc.)
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 20
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+
+podDisruptionBudget:
+  enabled: true
+  minAvailable: null
+  maxUnavailable: 1  
+  unhealthyPodEvictionPolicy: AlwaysAllow 
+monitoring:
+  serviceMonitor:
+    enabled: true
+    labels:
+      monitoring: "prometheus"
+    interval: 15s
+
+networkPolicy:
+  enabled: true
+  # Custom egress rules to allow database connectivity to an external DB.
+  # The chart's app/realtime NetworkPolicies already permit egress to
+  # `postgresql.service.targetPort` when `postgresql.enabled=true`. For an
+  # external DB on a different port (or off-cluster), append to extraRules.
+  egress:
+    extraRules:
+      - to: []
+        ports:
+        - protocol: TCP
+          port: 5432
+
+# Example deployment command with secure secret generation:
+# helm install sim ./helm/sim \
+#   --values ./helm/sim/examples/values-external-db.yaml \
+#   --set externalDatabase.host="your-db-host.com" \
+#   --set externalDatabase.username="your-db-user" \
+#   --set externalDatabase.password="your-db-password" \
+#   --set externalDatabase.database="your-db-name" \
+#   --set app.env.BETTER_AUTH_SECRET="$(openssl rand -hex 32)" \
+#   --set app.env.ENCRYPTION_KEY="$(openssl rand -hex 32)" \
+#   --set app.env.INTERNAL_API_SECRET="$(openssl rand -hex 32)" \
+#   --set app.env.CRON_SECRET="$(openssl rand -hex 32)" \
+#   --set app.env.API_ENCRYPTION_KEY="$(openssl rand -hex 32)" \
+#   --set realtime.env.BETTER_AUTH_SECRET="$(openssl rand -hex 32)"