chore: import upstream snapshot with attribution

helm/sim/examples/values-production.yaml

@@ -0,0 +1,245 @@
+# values-production.yaml
+#
+# When to use: generic production deployment on any cluster. Enables HA
+# (replicaCount > 1, PDB), NetworkPolicy, HPA, ServiceMonitor, and
+# PSS-restricted security defaults.
+#
+# Prerequisites:
+#   - A premium StorageClass with reclaimPolicy: Retain
+#   - cert-manager (for TLS) or pre-provisioned certs
+#   - ingress-nginx (or equivalent) for ingress
+#   - metrics-server in the cluster (HPA)
+#   - (recommended) Prometheus Operator for ServiceMonitor
+#   - (recommended) External Secrets Operator — see values-external-secrets.yaml
+#
+# Install:
+#   helm install sim ./helm/sim \
+#     --namespace sim --create-namespace \
+#     --values ./helm/sim/examples/values-production.yaml \
+#     --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+#     --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
+#     --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
+#     --set app.env.CRON_SECRET="$CRON_SECRET" \
+#     --set postgresql.auth.password="$POSTGRES_PASSWORD"
+
+# Global configuration
+global:
+  imageRegistry: "ghcr.io"
+  # For production, use a StorageClass with reclaimPolicy: Retain
+  storageClass: "managed-csi-premium"
+
+# Main application
+app:
+  enabled: true
+  replicaCount: 2
+
+  resources:
+    limits:
+      memory: "8Gi"
+      cpu: "2000m"
+    requests:
+      memory: "6Gi"
+      cpu: "1000m"
+  
+  # Production URLs (REQUIRED - update with your actual domain names)
+  env:
+    NEXT_PUBLIC_APP_URL: "https://sim.acme.ai"
+    BETTER_AUTH_URL: "https://sim.acme.ai"
+    SOCKET_SERVER_URL: "https://sim-ws.acme.ai"
+    NEXT_PUBLIC_SOCKET_URL: "https://sim-ws.acme.ai"
+    
+    # Security settings (REQUIRED - replace with your own secure secrets)
+    # Generate using: openssl rand -hex 32
+    BETTER_AUTH_SECRET: "your-production-auth-secret-here"
+    ENCRYPTION_KEY: "your-production-encryption-key-here"
+    INTERNAL_API_SECRET: "your-production-internal-api-secret-here"
+    CRON_SECRET: "your-production-cron-secret-here"
+
+    # Optional: API Key Encryption (RECOMMENDED for production)
+    # Generate 64-character hex string using: openssl rand -hex 32
+    API_ENCRYPTION_KEY: "your-64-char-hex-api-encryption-key-here"  # Optional but recommended
+    
+    # Email verification (set to true if you want to require email verification)
+    EMAIL_VERIFICATION_ENABLED: "false"
+    
+    # Optional third-party service integrations (configure as needed)
+    RESEND_API_KEY: "your-resend-api-key"
+    GOOGLE_CLIENT_ID: "your-google-client-id"
+    GOOGLE_CLIENT_SECRET: "your-google-client-secret"
+    # DISABLE_GOOGLE_AUTH: "true"                      # Uncomment to hide Google OAuth login
+    # DISABLE_GITHUB_AUTH: "true"                      # Uncomment to hide GitHub OAuth login
+
+# Realtime service
+realtime:
+  enabled: true
+  replicaCount: 2
+
+  resources:
+    limits:
+      memory: "1Gi"
+      cpu: "500m"
+    requests:
+      memory: "512Mi"
+      cpu: "250m"
+  
+  env:
+    NEXT_PUBLIC_APP_URL: "https://sim.acme.ai"
+    BETTER_AUTH_URL: "https://sim.acme.ai"
+    BETTER_AUTH_SECRET: "your-production-auth-secret-here"
+    ALLOWED_ORIGINS: "https://sim.acme.ai"
+
+# Database migrations
+migrations:
+  enabled: true
+  resources:
+    limits:
+      memory: "2Gi"
+      cpu: "1000m"
+    requests:
+      memory: "1Gi"
+      cpu: "500m"
+
+# PostgreSQL database
+postgresql:
+  enabled: true
+  
+  # Database authentication (REQUIRED - set secure credentials)
+  auth:
+    username: postgres
+    password: "your-secure-postgres-password"
+    database: simstudio
+  
+  # Resource allocation for production workloads
+  resources:
+    limits:
+      memory: "4Gi"
+      cpu: "2000m"
+    requests:
+      memory: "2Gi"
+      cpu: "1000m"
+  
+  # Persistent storage configuration
+  persistence:
+    enabled: true
+    storageClass: "managed-csi-premium"
+    size: 50Gi
+  
+  # SSL/TLS configuration (recommended for production)
+  tls:
+    enabled: true
+    certificatesSecret: postgres-tls-secret
+  
+  # PostgreSQL performance configuration for production
+  config:
+    maxConnections: 1000
+    sharedBuffers: "2GB"
+    maxWalSize: "8GB"
+    minWalSize: "160MB"
+
+# Ollama AI models (optional - enable if you need local AI model serving)
+ollama:
+  enabled: false
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: nginx
+  
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  
+  # Main application
+  app:
+    host: sim.acme.ai
+    paths:
+      - path: /
+        pathType: Prefix
+  
+  # Realtime service
+  realtime:
+    host: sim-ws.acme.ai
+    paths:
+      - path: /
+        pathType: Prefix
+  
+  # TLS configuration
+  tls:
+    enabled: true
+    secretName: sim-tls-secret
+
+# Horizontal Pod Autoscaler (automatically scales pods based on CPU/memory usage)
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 20
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 60
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 100
+        periodSeconds: 15
+      - type: Pods
+        value: 2
+        periodSeconds: 60
+
+# Pod disruption budget (ensures minimum availability during cluster maintenance)
+podDisruptionBudget:
+  enabled: true
+  minAvailable: null
+  maxUnavailable: 1  
+  unhealthyPodEvictionPolicy: AlwaysAllow 
+
+# Monitoring integration with Prometheus
+monitoring:
+  serviceMonitor:
+    enabled: true
+    labels:
+      monitoring: "prometheus"
+    interval: 15s
+    scrapeTimeout: 10s
+
+# Network policies (restricts pod-to-pod communication for security)
+networkPolicy:
+  enabled: true
+
+# Shared storage for data sharing between pods (enterprise feature)
+sharedStorage:
+  enabled: true
+  storageClass: "managed-csi-premium"
+  volumes:
+    - name: output-share
+      size: 100Gi
+      accessModes:
+        - ReadWriteMany
+    - name: model-share
+      size: 200Gi
+      accessModes:
+        - ReadWriteMany
+
+# Telemetry and observability (comprehensive monitoring and tracing)
+telemetry:
+  enabled: true
+  resources:
+    limits:
+      memory: "1Gi"
+      cpu: "500m"
+    requests:
+      memory: "512Mi"
+      cpu: "200m"
+  # Configure endpoints based on your observability infrastructure
+  prometheus:
+    enabled: true
+    endpoint: "http://prometheus-server/api/v1/write"
+  jaeger:
+    enabled: true
+    endpoint: "http://jaeger-collector:14250"