# Minimal Definite on-prem config for Amazon EKS.
#
# Assumes:
#   - An EKS cluster with a gp3 StorageClass available
#   - RDS Postgres reachable from cluster security group
#   - S3 bucket plus a programmatic IAM user with s3:* on the bucket;
#     export the access key pair into the env vars below
#   - aws-load-balancer-controller + cert-manager installed
#
# Why not IRSA? The Quack server uses DuckDB's httpfs extension, which speaks
# the S3 API directly via static credentials, not the AWS SDK. v1 will add
# IRSA support; for v0 you need an access key pair.
#
# Usage:
#   export POSTGRES_PASSWORD=...
#   export OIDC_CLIENT_SECRET=...
#   export S3_ACCESS_KEY_ID=...
#   export S3_SECRET_ACCESS_KEY=...

deployment:
  name: definite
  namespace: definite
  hostname: definite.acme.internal
  tls: cert_manager

postgres:
  url: postgres://definite:${POSTGRES_PASSWORD}@definite.cluster-xyz.us-east-1.rds.amazonaws.com:5432/definite

object_store:
  type: s3
  bucket: acme-definite-lake
  region: us-east-1
  credentials:
    key_id:
      env: S3_ACCESS_KEY_ID
    secret:
      env: S3_SECRET_ACCESS_KEY

lakehouse:
  prefix: lake/
  storage:
    size: 50Gi
    storage_class_name: gp3

auth:
  mode: oidc
  issuer: https://acme.okta.com
  client_id: definite-onprem
  client_secret:
    env: OIDC_CLIENT_SECRET

llm:
  provider: bedrock
  region: us-east-1
  model: anthropic.claude-opus-4-7-v1:0
  # Credentials via IRSA; no credentials block needed.

resources:
  api:
    replicas: 2
    cpu: "1"
    memory: 2Gi
  lakehouse:
    replicas: 1
    cpu: "4"
    memory: 16Gi
  frontend:
    replicas: 2
    cpu: 500m
    memory: 512Mi
  job_runner:
    replicas: 1
    cpu: 500m
    memory: 1Gi

# Override the container image registry / tag if you mirror images into ECR
# instead of pulling from ghcr.io/definite-app. Uncomment and customize.
#
# image:
#   registry: 123456789012.dkr.ecr.us-east-1.amazonaws.com/definite
#   tag: 0.0.1
#   pull_policy: IfNotPresent
#   pull_secrets:
#     - ecr-pull
