# Agent Relay on your own EKS cluster: site values.
#
# Apply after the chart's EKS profiles, in this order:
#   helm upgrade --install agent-relay charts/agent-relay --namespace agent-relay \
#     -f charts/agent-relay/values-eks.yaml \
#     -f charts/agent-relay/values-eks-native.yaml \
#     -f values.yaml
#
# Replace every placeholder first (step 9 of agentrelay.com/docs/self-hosting/install-eks does it with sed). This file
# holds no secret values: it only names Secrets and keys, listed at
# agentrelay.com/docs/self-hosting/secrets.
#
# Sizing: a small install for one or two teams (db.t4g.medium, m7g.large.search,
# 2 x m6i.large nodes scaling to 4). These are estimates that have not been load
# tested. agentrelay.com/docs/self-hosting ("Scaling up") has the changes for a larger install.
#
# Single-replica components are listed at agentrelay.com/docs/self-hosting under "Availability".

# One line per image: each holds that image's repository and digest, and every
# workload using it takes both from here. To move to a newer build or a new image
# name, change only that line. See the Images table at agentrelay.com/docs/self-hosting/install-eks.
x-pins:
  services-image: &services_image { repository: __IMAGE_REPO_PREFIX__/sessions-pipeline, digest: "sha256:77022c5b6a1d30f96f921d703eb27a1acada8ec273ad84aebdde24f8eddce305" }
  webapp-image: &webapp_image { repository: __IMAGE_REPO_PREFIX__/relay-webapp, digest: "sha256:dfdf6db66808d8fa6a2921e8bfcea2dfd6b0cd78fb1bb636fbb4bd3302bc21fa" }

components:
  relaycast: true
  relayauth: false
  sessionsPipeline: true
  relayhistory: false
  control: true
  webapp: true
  relayflows: false
  durableActors: false
  relayfile: false

global:
  # Fresh installs start every Services reader and writer on the qualified
  # ruleset-10 wasm-bindgen contract. Populated installs must follow the
  # reader-first two-revision procedure at agentrelay.com/docs/self-hosting/upgrades before applying this file
  # unchanged.
  scrubEngine:
    engine: wasm-bindgen
    required: wasm-bindgen
    readerMaxRuleset: "10"
  tenant:
    # Stable organization ID that partitions session data. Never change it after
    # the first upload.
    orgId: __ORG_ID__

relaycast:
  # PostgreSQL backend. The chart allows exactly one replica on this backend:
  # realtime, presence and rate limits are in-process, and uploads use one volume.
  runtime:
    backend: postgres
    postgres:
      image:
        repository: __IMAGE_REPO_PREFIX__/relaycast-self-host
        digest: sha256:ab9dd6781e68f09d5e2e686a17088f9ad533978ef13d974a47d6c212d8eedbde
  postgresCa:
    enabled: true
    configMap: rds-ca
    key: ca.crt
  # A SQLite-only setting that this backend refuses.
  retention:
    messageTtlDays: null
  baseUrl: https://cast.__DOMAIN__
  existingSecret: agent-relay-secrets
  persistence:
    enabled: true
    size: 20Gi
  networkPolicy:
    ingressFrom:
      - podSelector: {}
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_A__ }
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_B__ }

sessions-pipeline:
  # HoopDb is on RDS; rds-setup.sh runs its privileged bootstrap.
  hoopdb:
    enabled: false
  searchWorkerRole: { bootstrapJob: { enabled: false } }
  runtimeRole: { bootstrapJob: { enabled: false } }
  functionDefaultRevoke: { bootstrapJob: { enabled: false } }

  # The read API: session reads and search, on the history origin.
  sessionReadApi:
    enabled: true
    image: *services_image
    output: { enabled: true }
    digest: { enabled: true }
    replicas: 1
    origin: https://history.__DOMAIN__
    completeSince: epoch
    directoryWorkspaces: "*"
    events: { messageIds: true }
    turns: { assumeNoLegacy: true }
    login: { advertisesSync: false }
    config:
      existingSecret: agent-relay-read-api
      key: RELAYHISTORY_READ_API_SECRET
    postgres: { tlsProfile: custom-ca }
    postgresCa:
      enabled: true
      configMap: rds-ca
      key: ca.crt
      sha256: __RDS_CA_SHA256__
    search:
      backend: opensearch
      backendId: opensearch-main
      opensearch:
        url: __OPENSEARCH_URL__
        region: __REGION__
        indexPrefix: relayhistory
    auth:
      mode: self_issued
      relaycontrol: { enabled: false, url: "", existingSecret: "" }
      selfIssued:
        internalSecret:
          existingSecret: agent-relay-secrets
          key: session-read-api-secret
    cors:
      allowedOrigins:
        - https://__DOMAIN__
    networkPolicy:
      enabled: true
      controlFrom:
        - podSelector: { matchLabels: { app.kubernetes.io/name: relay-control } }
      publicFrom:
        - ipBlock: { cidr: __ALB_SUBNET_CIDR_A__ }
        - ipBlock: { cidr: __ALB_SUBNET_CIDR_B__ }
    serviceAccountName: agent-relay-session-read
    serviceAccountCreate: true
    extraEnv:
      - { name: LOCKER_BUCKET, value: __SESSIONS_BUCKET__ }
      - { name: LOCKER_REGION, value: __REGION__ }
      - { name: PIPELINE_ORG_FROM_PREFIX, value: "true" }
      - { name: PIPELINE_KEY_PREFIX, value: 96bulls }
      - { name: READ_API_CANONICAL_PIN_LAGGING_POINTER, value: "true" }
      - { name: READ_API_TIMING_ASSUME_NO_TURNS, value: "true" }
      - { name: READ_API_BRIEF_TITLES_WORKSPACES, value: "*" }
      - { name: READ_API_SESSION_QUERY, value: "true" }
      # How much of one session the read API loads. Raise it only together with
      # the memory limit below: 64MiB needs at least 1Gi.
      - { name: READ_API_CANONICAL_SCOPE_BYTES, value: "64MiB" }
    resources:
      requests: { cpu: 100m, memory: 256Mi }
      limits: { memory: 1536Mi }

  # The upload edge, on the same history origin.
  ingestEdge:
    enabled: true
    image: *services_image
    origin: https://history.__DOMAIN__
    allowInClusterHttp: true
    sessionSelection: true
    heartbeatAccept: true
    relaycontrol:
      url: http://relay-control.agent-relay.svc.cluster.local
    config:
      existingSecret: agent-relay-ingest-edge-runtime
      databaseUrlKey: database-url
      introspectSecretKey: introspect-secret
    postgres:
      caConfigMap: rds-ca
      caSha256: __RDS_CA_SHA256__
    serviceAccountName: agent-relay-session-ingest-api
    locker:
      bucket: __SESSIONS_BUCKET__
      region: __REGION__
      credentials: { mode: podIdentity }

  # Writes transcript search into OpenSearch. The chart runs exactly one replica.
  searchIndexer:
    enabled: true
    image: *services_image
    completeSince: epoch
    config: { existingSecret: search-indexer-runtime }
    search:
      backend: opensearch
      backendId: opensearch-main
      opensearch:
        url: __OPENSEARCH_URL__
        region: __REGION__
        indexPrefix: relayhistory
    locker:
      bucket: __SESSIONS_BUCKET__
      region: __REGION__
    postgres:
      tlsProfile: custom-ca
      caConfigMap: rds-ca
      caSha256: __RDS_CA_SHA256__
    bootstrap:
      enabled: true
      existingSecret: search-indexer-owner
    # Writes the Postgres facts used by Output, digest and coordination views.
    outputFacts:
      enabled: true

  # Reserved native-consumer cadence for the qualified cutover. The 2026.11.0
  # pack runs searchIndexer and leaves nativeConsumer disabled; if the native
  # consumer is enabled by a reviewed site overlay, reconcile every minute and
  # retain a lookback wider than that cadence.
  nativeConsumer:
    reconcileEveryMinutes: 1
    reconcileLookbackMinutes: 30

  worker:
    acknowledgeWorkloadRename: true
    image: *services_image
    existingSecret: agent-relay-secrets
    summaryEncryption:
      existingSecret: agent-relay-secrets
    postgresCa:
      enabled: true
      configMap: rds-ca
      key: ca.crt
      sha256: __RDS_CA_SHA256__
    hoopdb:
      existingSecret: agent-relay-secrets
      key: HOOPDB_URL
    migrations:
      hoopdb:
        existingSecret: agent-relay-secrets
        key: HOOPDB_MIGRATION_URL
      databaseMode: rds
      supabaseShim: false
      runtimeRole: sessions_pipeline_runtime
      runtimeRoleLogin: true
      functionBoundaryMode: global-default-revoke
      waitForRole: { enabled: false, functionDefault: false }
    locker:
      bucket: __SESSIONS_BUCKET__
      region: __REGION__
    # Session titles and briefs. Needs a workspace ID, which exists only after
    # first sign-in, so agentrelay.com/docs/self-hosting/after-install turns this on.
    nativeBrief:
      enabled: false
      image: *services_image
      workspaceIds: []
      model: __LLM_MODEL__
      sweepSeconds: 300
      # For an OpenAI-compatible gateway such as Bedrock, see agentrelay.com/docs/self-hosting/after-install.
      # baseUrl: https://<gateway>/v1
      # allowInClusterHttp: true   # only for an http Service URL
      openaiSecret:
        name: agent-relay-llm
        key: OPENAI_API_KEY
    components:
      session-brief:
        enabled: false
      bob-costas:
        # "off" writes extractive summaries only; agentrelay.com/docs/self-hosting/after-install sets a model.
        env:
          - { name: BOB_COSTAS_MODEL, value: "off" }

  # The legacy RelayAuth ingest path is unused here: uploads go to the ingest
  # edge. Only its Deployment is omitted; the ServiceAccount that the ingest edge
  # uses is still created.
  alleyoop:
    deployment:
      enabled: false
    postgresCa:
      enabled: true
      configMap: rds-ca
      key: ca.crt
    image: *services_image
    hoopdb:
      existingSecret: agent-relay-secrets
      key: HOOPDB_URL
    existingSecret: agent-relay-secrets
    locker:
      bucket: __SESSIONS_BUCKET__
      region: __REGION__
    auth:
      historyOrigin: https://history.__DOMAIN__
      allowInterimRelayAuthBearer: false
    environment: production

relay-control:
  image:
    repository: __IMAGE_REPO_PREFIX__/relay-control
    digest: sha256:0b9c5a077b49b31178cc669e7c1d532f39e64c840087ca41636bb84a6c62631c
  # The chart allows one replica: login and device rate limits are per process.
  replicaCount: 1
  existingSecret: agent-relay-secrets
  secretKeys:
    relayauthApiKey: ""
    introspectSecret: relaycontrol-introspect-secret
    relaycastInternalSecret: relaycast-internal-secret
    sessionReadApiSecret: session-read-api-secret
    # First admin signs in with this one-time key (step 16 of the install guide): no SMTP needed.
    setupKey: selfhost-setup-key
    # Set to smtp-password, and fill in the smtp block below, only if you add SMTP.
    smtpPassword: ""
  bootstrap:
    orgName: __ORG_NAME__
    adminEmail: __ADMIN_EMAIL__
    workspaceName: Default
  # Optional. Password sign-in, the setup key and temporary passwords work
  # without email. With SMTP, users can also self-register and reset passwords.
  # smtp:
  #   host: <smtp host>
  #   port: 587
  #   security: starttls
  #   username: <smtp username>
  #   from: "Agent Relay <relay@<domain>>"
  auth:
    password:
      enabled: true
    # One hop: the load balancer. Rate limits depend on this being right.
    trustedProxies: 1
  # Owner-only Usage and qualified MCP agent launch. Flows, Chief and Relayfile
  # remain outside this install.
  selectedFeatures: [usage, launch]
  publicUrl: https://api.__DOMAIN__
  dashboardUrl: https://__DOMAIN__/
  services:
    relaycastPublicUrl: https://cast.__DOMAIN__
    relayauthEnabled: false
    relayauthUrl: ""
    relayhistoryUrl: ""
    relayhistoryPublicUrl: ""
    relayhistoryBackend: native
    sessionReadApiUrl: http://agent-relay-read-api.agent-relay.svc.cluster.local
    sessionReadApiPublicUrl: https://history.__DOMAIN__
    sessionReadApiMcpReads: true
  introspection:
    audiences:
      - https://history.__DOMAIN__
      - https://api.__DOMAIN__
  postgresCa:
    enabled: true
    configMap: rds-ca
    key: ca.crt
  networkPolicy:
    ingressFrom:
      - podSelector: {}
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_A__ }
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_B__ }

relay-webapp:
  image: *webapp_image
  # The chart allows one replica.
  replicaCount: 1
  runtime:
    publicUrl: https://__DOMAIN__
    sessionReadApiEnabled: true
    # The backend endpoint is enabled; keep its web view explicitly default-off.
    coordinationOverlapsEnabled: false
  networkPolicy:
    ingressFrom:
      - podSelector: {}
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_A__ }
      - ipBlock: { cidr: __ALB_SUBNET_CIDR_B__ }