# Default values for kerberoshub.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

###########################################################################
# LICENSING information: you will a license to run Kerberos Hub.
# ----
# Get your license from support@kerberos.io
#license: "---ENTER-YOUR-LICENSE-HERE---"
# License for 8 cameras (for more cameras, please contact us for a private license)
license: "L/+FAwEBB2xpY2Vuc2UB/4YAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMw/4YB/gEl/8wQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZf+BAwEBB0xpY2Vuc2UB/4IAAQwBAklkAf+EAAEDS2V5AQwAAQdDb21wYW55AQwAAQdFeHBUaW1lAQQAAQREYXlzAQQAAQdDYW1lcmFzAQQAAQVTaXRlcwEEAAEGVmF1bHRzAQQAAQpNZWRpYUxpbWl0AQQAAQlQZXJwZXR1YWwBAgABBkFjdGl2ZQECAAEJSXBBZGRyZXNzAQwAAAAY/4MBAQEIT2JqZWN0SUQB/4QAAQYBGAAAPf+COgEMAAAAAAAAAAAAAAAAAg9nZW5lcmljLWxpY2Vuc2UB+AJl6LAHsRMYAfoB0alKIAABEAEUARQDAQAB/gIAFlQqo9yJj1a3OH1+5iGjCPcz9VtrRuGfz/iuQEFohbCfSiZGAdHh16gEc59Z2kPaey+eJcwY0BQsBoipW7SwFRmcHkrWLuxt+Yzi2kvwmL4TN0quWqM4xxBzH1sejS6kZpPm7bw11JBsBuaNOYMbl5lgpPCFajWUH6GzfmuQlptNQKosocacI/9PaaqEUUM0ALjDZNSqqFwZPPsFh9WTeaHGbRbmwQRMPFDgaPCxiHnCCUagbvuVZeOQbKaR5gPTUfPQY/L4mrN9QnMxdzwUJgqm7FbTH4UhoZn6EEzNGTN6DbHhpx8lezzCRW8dzMNuK8R1igiORV5gdWOPzBMZlTgodIZRD07e8iAo2XqT/BWcqaJXutdqXltaiJKshh2QzStdv2WZUynVTguYIQJyBNhrXEkewKZA0UftcSemDPkCmp6VovMMveV4X3Cpzkm7ZHtE7j39At/kpuqY/icTEzRWYuQqEDtqXMVar84VOpgVhxeNrrqZniLq8o3ezRdwy0BJG5xT9cuMxq13ZB3Am9iqTSjx2mh5VZZeB33GjLVAtLscj8NoKWy7BThchXB9xwoiy2RLO8nE+EI8wPbg+ajb2Ta7AFyxHgJJU6cea+zEpiBMARwjPKqk2nn02xdfdqMzQ+E9e115sIqhotBM5RI7uBIf8DDwT93HLsJZRBAA"
licenseServer:
  url: "https://license.kerberos.io/verify"
  token: "214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM" # do not change otherwise Kerberos Hub will not work.
# Private Docker Registry: The registry secret is required if you have your Docker images behind a private registry.
# By default it will pull from Docker hub (https://hub.docker.com/r/kerberos).
#imagePullSecrets:
#  - name: regcred

# When using a private registry, you can specify the registry here.
global:
  imageRegistry: "docker.io/"
# Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'.
# Set to 'true' if this is a private deployment.
environment: "production"
# Set to 'true' if this is a private deployment.
isPrivate: true
# If you plan a migration or doing maintenance, you can enable readonly.
# This will stop any write process to mongodb or any processing done in the Kerberos Hub pipeline.
readOnly: false
# Which network ingress you are using in your Kubernetes Cluster
# Leaving the ingress empty will disable the ingress.
ingress: "" # or "traefik" / "nginx"
# A mongodb instance is required to store all the relevant metadata (this can be standalone or in a cluster).
mongodb:
  # MongoDB URI (for example for a SaaS service like MongoDB Atlas)
  # If uri is set, the below properties are not used (host, adminDatabase, username, password)
  #uri: "mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"
  # Self-hosted mongodb, you could also use the uri property above.
  host: mongodb.mongodb
  adminDatabase: admin
  username: "root"
  password: "yourpassword"
# A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional
# communication between Kerberos Agents and Kerberos Hub.
# we recommend to use vernemq (as part of this installation), but a stand-alone mosquitto broker is also possible.
mqtt:
  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Kerberos Agents and Kerberos Hub)
  port: "31443"
  protocol: "wss"
  username: "yourusername"
  password: "yourpassword"
  legacy:
    host: ""
    port: ""
# We are using a pipeline that is orchestrated through Kafka topics or RabbitMQ queues
# Events are send back and forth until the processing is done.
queueProvider: "RABBITMQ" # or "KAFKA"
queueName: "kcloud-event-queue" # This is the topic to which all events are send.
# RabbitMQ can be installed in the same cluster using a helm chart, or you can
# use a service on  cloud provider like AWS, GCP, Azure, etc.
rabbitmq:
  host: "rabbitmq.rabbitmq:5672" # can be internal dns name or external
  #host: "amqps://b-xxx-xxx-xxx-xxx-xxx.mq.eu-central-1.amazonaws.com:5671"
  username: "yourusername"
  password: "yourpassword"
  exchange: ""
# If you already have a Kafka cluster you might use this instead of RabbitMQ.
kafka:
  broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
  username: "yourusername"
  password: "yourpassword"
  mechanism: "PLAIN"
  security: "SASL_PLAINTEXT"
# For allowing WEBRTC a STUN and TURN server is required.
# You might want to install coturn in a seperate VM.
# -> https://help.hcltechsw.com/sametime/11.6/admin/turnserver_ubuntu.html

turn:
  host: "turn:turn.yourdomain.com:8443" # this needs to be a public accessible DNS name.
  username: "username1"
  password: "password1"
# (optional) OpenAI integration, used for semantic search
# Langchain is used to translate text to a filter on the media page
openai:
  enabled: false
  apikey: "xxx"
# We have a kerberos vault component installed which contains all the
# recordings. Kerberos vault is queried to retrieve the recordings
# from the appropriate provider.

kerberosvault:
  #uri: "http://vault-lb.kerberos-vault" # this needs to be a public accessible DNS name.
  uri: http://vault-nodeport.kerberos-vault:80/api
  provider: "minio"
  accesskey: "XJoi2@bgSOvOYBy#"
  secretkey: "OGGqat4lXRpL@9XBYc8FUaId@5"
  # Archiving is used when creating a task. The underlying recording of the task will be copied from its
  # existing provider to the below archived provider. Seperate credentials are used, as it makes possible to
  # specify another retention period.
  archive:
    provider: "minio"
    accesskey: "XJoi2@bgSOvOYBy#"
    secretkey: "OGGqat4lXRpL@9XBYc8FUaId@5"
  thumbnail:
    provider: "minio"
    accessKey: "XJoi2@bgSOvOYBy#"
    secretKey: "OGGqat4lXRpL@9XBYc8FUaId@5"
  sprite:
    provider: "minio"
    accessKey: "XJoi2@bgSOvOYBy#"
    secretKey: "OGGqat4lXRpL@9XBYc8FUaId@5"
email:
  provider: "mailgun"
  from: "support@yourdomain.com"
  displayName: "yourdomain.com"
  mailgun:
    domain: "mg.yourdomain.com"
    apikey: "xxxx"
  smtp:
    server: "smtp.yourdomain.com"
    port: "465"
    username: "yourusername"
    password: "yourpassword"
  templates:
    welcome: "welcome"
    welcomeTitle: "Welcome to Kerberos Hub"
    activate: "activate"
    activateTitle: "Wonderful! Your Kerberos Hub is now active"
    forgot: "forgot"
    forgotTitle: "Password reset Kerberos Hub. You forgot your password"
    share: "share"
    shareTitle: "[Action] You received a recording from Kerberos Hub"
    detection: "detection"
    disabled: "disabled"
    highupload: "highupload"
    device: "device"
    alertTitle: "[Alert] Kerberos Hub detected something an event"
    deviceTitle: "[Device] A Kerberos Agent's status has been changed"
# Following are all the different deployments needed to make
# Kerberos hub properly working.
kerberoshub:
  admin:
    repository: uugai/admin
    pullPolicy: IfNotPresent
    tag: "v1.0.2"
    replicas: 1
    resources:
      requests:
        memory: 100Mi
        cpu: 100m
      limits:
        memory: 100Mi
        cpu: 100m
  api:
    repository: uugai/hub-api
    pullPolicy: IfNotPresent
    tag: "v1.6.8"
    replicas: 1
    jwtSecret: "I1JcwzW3A0t_THIS-IS_NOT_A_SECRET_WJK9jnPkipbnVTpf0efMy" # change to a random value, this is for generating JWT tokens.
    schema: "http"
    url: "ip-address:32081"
    resources:
      requests:
        memory: 100Mi
        cpu: 100m
      limits:
        memory: 100Mi
        cpu: 100m
    # E-mail templates
    #volumeMounts:
    #  - name: custom-email-templates
    #    mountPath: /mail
    #volumes:
    #  - name: custom-email-templates
    #    persistentVolumeClaim:
    #      claimName: custom-layout-claim

    # When migrating to another url, this might help migrating.
    #legacyUrl: "api.legacy.yourdomain.com"

    # MFA issuer name
    mfaIssuer: "Kerberos.io"
    # Admin API's are made available for automation of Kerberos Hub.
    # To access those API's (e.g. creation of owner users), an API key needs to be provided.
    apiKey: "Z6GPfDdYj8mxLyy6iUJVf9yBlri9lhsW"
    ## Certificates
    #tls:
    #  - hosts:
    #      - "api.yourdomain.com"
    #    secretName: kerberoshub-api
    #- hosts:
    #    - "api.legacy.yourdomain.com"
    #  secretName: kerberoshub-api-legacy
    #  - hosts:
    #      - "admin.api.yourdomain.com"
    #    secretName: kerberoshub-admin
    language: "english"
    fallbackLanguage: "english"
    # Legacy (reseller) it is possible to link to AWS S3 and IAM (however Kerberos Vault is now the recommended option).
    # This is primarily used for creation of subscriptions, and not needed if you are using mainly Kerberos Vault.
    aws:
      region: "xxx"
      bucket: "xxx"
      accessKey: "xxx"
      secretKey: "xxx"
    stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
      privateKey: "xxx"
    slack: # Slack is used in the api, to send logs to a specific Slack channel.
      enabled: "true"
      hook: "yourslackhook" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ
      username: "Kerberos Hub" # The slack username
    elasticsearch: # Logs of the kerberos hub will be send to an elastic search cluster.
      enabled: "false"
      protocol: "http"
      host: "yourelasticsearchinstance.com"
      port: "9200"
      index: "kerberos-cloud"
      username: ""
      password: ""
      #sso: # OIDC settings for allowing SSO.
      #  - domain: "uug.ai"
      #    redirectUrl: "https://api.cloud.kerberos.io/sso/callback/uug.ai"
      #    forceSSO: "false"
      #    issuer: "https://xxx.eu.auth0.com/"
      #    claimId: "email" # claim which is used to identify the user
      #    clientId: "xxx"
      #    clientSecret: "xxx"
      #    clientVerificationId: "" # This is only required for SSO chaining.
      #  - domain: "kerberos.io"
      #    redirectUrl: "https://api.cloud.kerberos.io/sso/callback/kerberos.io"
      #    forceSSO: "false"
      #    issuer: "https://accounts.google.com"
      #    claimId: "email" # claim which is used to identify the user
      #    clientId: "xxx"
      #    clientSecret: "xxx"
      #    clientVerificationId: "" # This is only required for SSO chaining.
  frontend:
    repository: uugai/hub-frontend
    pullPolicy: IfNotPresent
    tag: "v1.6.7"
    replicas: 1
    schema: "http"
    url: "yourdomain.com"
    resources:
      requests:
        memory: 100Mi
        cpu: 100m
      limits:
        memory: 100Mi
        cpu: 100m
    # The front-end but in read-only mode
    #demoUrl: "demo.yourdomain.com"
    # When migrating to another url, this might help migrating.
    #legacyUrl: "legacy.yourdomain.com"
    #tls:
    #  - hosts:
    #      - "yourdomain.com"
    #    secretName: kerberoshub
    #  - hosts:
    #      - "legacy.yourdomain.com"
    #    secretName: kerberoshub-legacy
    #demoTls:
    #  - hosts:
    #      - "demo.yourdomain.com"
    #    secretName: kerberoshub-demo
    mixpanel: # We can keep track logging in Mixpanel as well
      apikey: "xxx"
    sentry: # We can trace errors in Sentry
      url: "https://xxx@sentry.io/xxx"
    stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
      publicKey: ""
    googlemaps: # Google maps is used inside the application to visualise cameras and sites.
      apikey: "xxxx"
    zendesk: # We can use different support tools, for now we use Zendesk but others can be integrated
      url: "yourdomain.zendesk.com"
    posthog: # Posthog is used for auditing and user interaction logging
      key: "xxx"
      url: "https://posthog.domain.com"
    # You can disable the Kerberos agent buttons, this make sense
    # in a white-label setup, or where you are managing the Kerberos Agents for your customers.
    hideAddAgent: "true"
    # Multi tenancy (domains)
    # By default the Kerberos Hub allows multi-tenancy through the concept
    # of accounts and subaccounts. However through the concept of domains, you
    # take it a step further. Within a domain, user accounts are unique, and are prefixed by a (domain\).
    #multiTenant: true
    #tenantBaseDomain: "yourdomain.com" # this would resolve in following sub domain "https://domain.kerberos.io"

    # Page title (browser)
    title: "Kerberos Hub - Video surveillance as it should be"
    # You can style Kerberos hub as you wish.
    # 1. we do the styling on our side and bake it in the Docker image (change the logo attribute to your company name)
    # 2. you bring your own logo (set logo to 'custom'), and mount the css file and favicons.
    # we will need to include your logo in the Docker image, so please reach out to us.
    logo: "custom"
    # Custom layout: override css
    # By providing a style.css file in the custom folder
    # this file will override any css styling.
    #volumeMounts:
    #  - name: custom-layout
    #    mountPath: /usr/share/nginx/html/assets/custom
    #volumes:
    #  - name: custom-layout
    #    persistentVolumeClaim:
    #      claimName: custom-layout-claim
    # By specifying the below environments variables, you can tweak the
    # headings and paragraphs of Kerberos Hub front-end.
    # Login page
    loginDescription: ""
    loginCopyright: ""
    # Dashboard page
    dashboardTitle: ""
    dashboardSubTitle: ""
    # Latest events page
    latestEventsTitle: ""
    latestEventsSubTitle: ""
    # Livestream/view page
    livestreamTitle: ""
    livestreamSubTitle: ""
    # Media page
    mediaTitle: ""
    mediaSubTitle: ""
    # Optional - for custom page.
    cpuUsageDescription: ""
    framesPerSecondDescription: ""
    mlaUtilizationDescription: ""
    objectsDetectedDescription: ""
    # You can add custom links to the navigation bar.
    navigationLinkTitle1: ""
    navigationLinkUrl1: ""
    navigationLinkTitle2: ""
    navigationLinkUrl2: ""
    navigationLinkTitle3: ""
    navigationLinkUrl3: ""
    navigationLinkTitle4: ""
    navigationLinkUrl4: ""
    navigationLinkTitle5: ""
    navigationLinkUrl5: ""
  support:
    enabled: false
  oauth2Proxy:
    enabled: false
    github:
      clientId: "github-client-id"
      clientSecret: "github-client-secret"
      cookieSecret: "generate-a-random-cookie-secret"
      organization: "github-organization"
      team: "github-team"
  cleanup:
    repository: uugai/hub-cleanup
    pullPolicy: IfNotPresent
    tag: "v1.4.1"
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
  monitordevice:
    repository: uugai/hub-monitor-device
    pullPolicy: IfNotPresent
    tag: "v1.3.0"
    resources:
      requests:
        memory: 50Mi
        cpu: 100m
      limits:
        memory: 50Mi
        cpu: 100m
        # E-mail templates
        #volumeMounts:
        #  - name: custom-email-templates
        #    mountPath: /mail
        #volumes:
        #  - name: custom-email-templates
        #    persistentVolumeClaim:
        #      claimName: custom-layout-claim
  reactivate:
    repository: uugai/hub-reactivatesubscriptions
    pullPolicy: IfNotPresent
    tag: "v1.0.2"
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  forwarder:
    enabled: false
    #repository: kerberos/vault-forwarder
    #pullPolicy: IfNotPresent
    #tag: "1.0.2732389692"
    #resources:
    #  requests:
    #    memory: 10Mi
    #    cpu: 10m
  # This proxy is legacy for the old agent, will be migrated in the new Hub API.
  proxy:
    repository: uugai/hub-proxy
    pullPolicy: IfNotPresent
    tag: "v1.0.0"
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
kerberospipeline:
  event:
    repository: uugai/hub-pipeline-event
    pullPolicy: IfNotPresent
    tag: "v1.2.0"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  monitor:
    repository: uugai/hub-pipeline-monitor
    pullPolicy: IfNotPresent
    tag: "v1.3.5"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  sequence:
    repository: uugai/hub-pipeline-sequence
    pullPolicy: IfNotPresent
    tag: "v1.6.6"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  throttler:
    repository: uugai/hub-pipeline-throttler
    pullPolicy: IfNotPresent
    tag: "v1.2.0"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  notify:
    repository: uugai/hub-pipeline-notification
    pullPolicy: IfNotPresent
    tag: "v1.0.20"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
        # E-mail templates
        #volumeMounts:
        #  - name: custom-email-templates
        #    mountPath: /mail
        #volumes:
        #  - name: custom-email-templates
        #    persistentVolumeClaim:
        #      claimName: custom-layout-claim
  notifyTest:
    repository: uugai/hub-pipeline-notification-test
    pullPolicy: IfNotPresent
    tag: "v1.2.1"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
        # E-mail templates
        #volumeMounts:
        #  - name: custom-email-templates
        #    mountPath: /mail
        #volumes:
        #  - name: custom-email-templates
        #    persistentVolumeClaim:
        #      claimName: custom-layout-claim
  analysis:
    repository: uugai/hub-pipeline-analysis
    pullPolicy: IfNotPresent
    tag: "v1.6.1"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  dominantColor:
    repository: uugai/hub-pipeline-dominantcolors
    pullPolicy: IfNotPresent
    tag: "v1.2.0"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  thumbnail:
    repository: uugai/hub-pipeline-thumbnail
    pullPolicy: IfNotPresent
    tag: "v1.2.1"
    replicas: 1
    quality: "1" # 1 (best) - 31 (worst)
    width: "600"
    height: "-1"
    kerberosvault:
      enabled: true # If you want to use Kerberos Vault to store the thumbnails
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  counting:
    repository: uugai/hub-pipeline-counting
    pullPolicy: IfNotPresent
    tag: "v1.6.2"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
  sprite:
    enabled: true # Enable or disable the sprite generation 'true' or 'false
    repository: uugai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
    tag: "v1.0.9"
    replicas: 1
    interval: "1" # Number of secondes between each thumbnail in the sprite
    width: "240" # Should not be changed for the moment (hard coded in UI)
    height: "135" # Should not be changed for the moment (hard coded in UI)
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
      limits:
        memory: 50Mi
        cpu: 50m
  export:
    repository: uugai/hub-pipeline-export
    pullPolicy: IfNotPresent
    tag: "v1.0.0"
    replicas: 1
    resources:
      requests:
        memory: 50Mi
        cpu: 50m
