# Default values for rspamd.
replicaCount: 1

image:
  repository: interlegis/alpine-rspamd
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

rspamd:
  password: apassword
  rateLimits:
    # Limit for all mail per recipient (default rate 70 per day)
    to: "70 / 1d"
    # Limit for all mail per one source ip (default rate 150 per day)
    toIp: "150 / 1d"
    # Limit for all mail per one source ip and from address (default rate 100 per day)
    toIpFrom: "100 / 1d"
    # Limit for all mail per authenticated user (default rate 100 per day)
    user: "100 / 1d"
    maxRcpt: 50
    whitelisted:
      rcpts: "postmaster,mailer-daemon,<>"
      ips:
        - "127.0.0.1"
        - "192.168.0.0/16"
        - "172.16.0.0/12"
        - "10.0.0.0/8"
        - "[::1]/128"
  dkimSigning:
    # If false, messages with empty envelope from are not signed
    allow_envfrom_empty: "true"
    # If true, envelope/header domain mismatch is ignored
    allow_hdrfrom_mismatch: "false"
    # If true, multiple from headers are allowed (but only first is used)
    allow_hdrfrom_multiple: "true"
    # If true, username does not need to contain matching domain
    allow_username_mismatch: "false"
    # If false, messages from authenticated users are not selected for signing
    auth_only: "true"
    # Default path to key, can include 'domain' and 'selector' variables
    path: "/var/lib/rspamd/dkim/$domain.$selector.key"
    # Default selector to use
    selector: "dkim"
    # If false, messages from local networks are not selected for signing
    sign_local: "true"
    # Symbol to add when message is signed
    symbol: "DKIM_SIGNED"
    # Whether to fallback to global config
    try_fallback: "true"
    # Domain to use for DKIM signing: can be "header" or "envelope"
    use_domain: "header"
    # Whether to normalise domains to eSLD
    use_esld: "false"
    # Whether to get keys from Redis
    use_redis: "false"
    # Hash for DKIM keys in Redis
    key_prefix: "DKIM_KEYS"

  workerProxy:
    milter: "yes"
    timeout: "120s"
    count: 4 # Spawn more processes in self-scan mode
    maxRetries: 5 # How many times master is queried in case of failure
    discardOnReject: false # Discard message instead of rejection
    quarantineOnReject: false # Tell MTA to quarantine rejected messages
    spamHeader: "X-Spam" # Use the specific spam header
    rejectMessage: "Spam message rejected" # Use custom rejection message

service:
  type: ClusterIP
  ports:
    antispam: 11333
    http: 11334
    milter: 11332

ingress:
  enabled: false
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources: {}
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 2
  maxReplicas: 6
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

nodeSelector: {}

tolerations: []

affinity: {}

# Redis definitions
redis:
  image:
    tag: 7.0.3-debian-11-r0
    pullPolicy: IfNotPresent
  architecture: standalone
  auth:
    enabled: true
    password: agoodredispassword
  master: 
    persistence:
      enabled: true
      accessModes:
        - ReadWriteOnce
      size: 2Gi
    resources:
      requests:
        cpu: 50m
        memory: 150Mi
      limits:
        cpu: 800m
        memory: 1Gi