values.yaml

planeVersion: v3.1.4

dockerRegistry:
  enabled: false
  registry: 'index.docker.io/v1/'
  loginid: ''
  password: ''
  # Name of an existing Kubernetes secret containing docker registry credentials
  existingSecret: ''

license:
  licenseServer: https://prime.plane.so
  licenseDomain: 'plane.example.com'

airgapped:
  enabled: false
  # The boto module used by API does not use the CA bundles in the container, so we need to
  # mount the CA bundle into the API pod by passing it in as an environment
  # variable.
  # Preferred: list of Kubernetes Secrets containing CA certificates (supports multiple certs).
  # Example:
  # s3Secrets:
  #   - name: plane-s3-ca
  #     key: s3-custom-ca.crt
  #   - name: plane-s3-ca-2
  #     key: s3-custom-ca-2.crt
  s3Secrets: []

  # Deprecated (backward compatibility): use a single secret for custom S3 CA.
  # If set, used when s3Secrets is empty. Prefer migrating to s3Secrets.
  # Example:
  # s3SecretName: plane-s3-ca
  # s3SecretKey: s3-custom-ca.crt
  s3SecretName: ""
  s3SecretKey: ""

ingress:
  enabled: true
  minioHost: ''
  rabbitmqHost: ''
  # Selects which ingress template is rendered:
  #   'traefik*'          -> Traefik IngressRoute CRD      (templates/ingress-traefik.yaml)
  #   'openshift'         -> OpenShift Route per path      (templates/ingress-openshift.yaml)
  #   'nginx'             -> networking.k8s.io/v1 Ingress  (templates/ingress.yaml)
  # Any OTHER value renders no ingress at all -- see the note in templates/ingress.yaml.
  ingressClass: 'traefik'
  # Annotations for the standard Ingress — e.g. to set the proxy body size limit on
  # the nginx controller. ONLY rendered when ingressClass is exactly 'nginx'; they
  # have no effect with traefik, and the 'openshift' Route path takes its
  # annotations from ingress.openshift.route_annotations instead. Example:
  # - proxy-body-size: nginx equivalent of traefik's maxRequestBodyBytes (upload size limit).
  # - proxy-buffer-size: size of the buffer for the response headers from upstream; bump this to avoid
  #   "502 upstream sent too big header" errors.
  # ingress_annotations: { "nginx.ingress.kubernetes.io/proxy-body-size": "5m", "nginx.ingress.kubernetes.io/proxy-buffer-size": "16k" }
  traefik:
    maxRequestBodyBytes: 20971520 # in bytes (default: 20 MiB)
    # Traefik entrypoints the IngressRoute attaches to. Leave empty to derive them
    # from your SSL settings, which is what you want in almost every case:
    #   - TLS configured (ssl.tls_secret_name, or generateCerts + createIssuer)
    #     -> ['websecure'], and a `tls:` block is emitted.
    #   - No TLS configured -> ['web'], plain HTTP, and NO `tls:` block. Use this
    #     to reach Plane over http:// while you are still sorting out DNS/certs,
    #     or when TLS is terminated upstream (cloud LB, Cloudflare, a service mesh).
    # Set explicitly only if your Traefik install renamed the default entrypoints,
    # e.g. entryPoints: ['websecure', 'web'] or ['https'].
    entryPoints: []
  # Only read when ingressClass is 'openshift'.
  openshift:
    # HAProxy's per-route timeout. The router default is 30s, which severs
    # /live/'s collaborative-editing WebSockets and /pi/'s streaming responses.
    timeout: '300s'
    termination: 'edge' # edge | reencrypt (passthrough cannot do path routing)
    insecureEdgeTerminationPolicy: 'Redirect'
    # Name of a TLS Secret for the router to serve instead of its wildcard cert.
    # Requires OpenShift 4.16+ and a RoleBinding letting the router read it.
    externalCertificate: ''
    # Extra annotations applied to every Route, e.g. rate limiting or
    # haproxy.router.openshift.io/rewrite-target on a path that needs stripping.
    route_annotations: {}
    # NOTE: OpenShift Routes have NO equivalent of Traefik's body-limit
    # Middleware. maxRequestBodyBytes above is not enforced on this path.

ssl:
  tls_secret_name: '' # If you have a custom TLS secret name
  # If you want to use Let's Encrypt, set createIssuer and generateCerts to true
  createIssuer: false
  issuer: http # Allowed : cloudflare, digitalocean, http
  token: '' # not required for http
  server: https://acme-v02.api.letsencrypt.org/directory
  email: plane@example.com
  generateCerts: false
  # Set true when TLS is terminated IN FRONT of Plane and this chart manages no
  # certificate of its own -- a cloud load balancer, Cloudflare, a service mesh,
  # or a Traefik entrypoint that carries its own cert (websecure.http.tls=true).
  #
  # The chart then renders every self-referential URL handed to the app
  # (APP_BASE_URL, PLANE_FRONTEND_URL, PLANE_OAUTH_REDIRECT_URI,
  # EXPORT_DOWNLOAD_BASE_URL, ...) with an https:// scheme. No `tls:` block is
  # emitted, because there is no Secret for this chart to reference.
  #
  # This does NOT change the Traefik entrypoint. An upstream terminator (ALB,
  # NLB TLS listener, Cloudflare) forwards cleartext, which arrives on `web` --
  # the default. If TLS is instead terminated by Traefik's own entrypoint
  # (websecure.http.tls=true), also set:
  #   ingress.traefik.entryPoints: ['websecure']
  # otherwise the route binds `web` and never matches the TLS traffic.
  #
  # Leave false if you set tls_secret_name or generateCerts -- those already
  # imply https. This is only for TLS this chart cannot see.
  externalTermination: false

# ============================================================
# Pod Security (Kubernetes Pod Security Admission "restricted")
# ============================================================
# When enabled, applies a hardened pod- and container-level securityContext to
# all first-party Plane workloads: api, web, space, admin, live, worker,
# beat-worker, automation-consumer, outbox-poller, silo, monitor, iframely,
# runner, pi-api/beat/worker, and the migration Jobs (including their busybox
# init containers). Plane's images run fine as non-root, so these defaults
# satisfy the PSA "restricted" profile.
#
# ------------------------------------------------------------------
# WHICH RECIPE DO I WANT?
# ------------------------------------------------------------------
#
# 1) Leave it off (the default). Containers start as root and each entrypoint
#    drops to the `plane` user (uid 1000) itself. Fine for Docker Compose and
#    for clusters with no Pod Security Admission policy.
#
#      securityContext:
#        enabled: false
#
# 2) Non-root, uid 1000. Satisfies the PSA "restricted" profile. This is the
#    common Kubernetes choice and needs nothing but the toggle:
#
#      securityContext:
#        enabled: true
#
# 3) Non-root, but YOUR platform pins a specific UID (e.g. 10001):
#
#      securityContext:
#        enabled: true
#        podSecurityContext:
#          runAsUser: 10001
#          runAsGroup: 10001
#          fsGroup: 10001
#        containerSecurityContext:
#          runAsUser: 10001
#
# 4) OpenShift, or any platform that ASSIGNS the UID for you.
#    Set the three id fields to `null`. A null in your values file removes the
#    key entirely during Helm's value merge, so the rendered securityContext
#    keeps runAsNonRoot / seccompProfile / dropped capabilities but names no
#    UID -- which is exactly what OpenShift's `restricted-v2` SCC requires:
#
#      securityContext:
#        enabled: true
#        podSecurityContext:
#          runAsUser: null
#          runAsGroup: null
#          fsGroup: null
#        containerSecurityContext:
#          runAsUser: null
#      services:
#        email_service:
#          runAsUser: null       # this service pins its own; see below
#
#    Do NOT instead leave the 1000s in place: `restricted-v2` validates with
#    MustRunAsRange and REJECTS any pod requesting an id outside the namespace's
#    assigned range, so every pod would fail admission and nothing would
#    schedule. Ready-made: `-f examples/values-openshift.yaml`, which also
#    selects the OpenShift ingress path and forces the bundled datastores off.
#
#    Requires images that grant group 0 write access to their runtime paths.
#    Older images crash under an assigned UID, e.g. nginx exits with
#    `mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)`.
#
# ------------------------------------------------------------------
# WHAT THIS DOES NOT COVER
# ------------------------------------------------------------------
#   - The bundled local infrastructure (postgres, redis, rabbitmq, minio,
#     opensearch): third-party images with their own UID/GID requirements,
#     intended for local/dev use. In hardened clusters run those externally
#     (managed RDS, ElastiCache, etc.) and leave local_setup off. They cannot
#     run under an assigned UID at all.
#   - The email service's UID only. Its image's app-user is uid 100 and owns
#     /opt/email, so it keeps its own `services.email_service.runAsUser`; it
#     still takes runAsNonRoot / capabilities / seccomp from the block below.
#
# Mirrors the kustomize `nonroot-security-context` component (and, for recipe 4,
# `openshift-security-context`).
securityContext:
  enabled: false
  # Rendered at spec.template.spec.securityContext (pod level).
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  # Rendered at each container's / initContainer's securityContext.
  containerSecurityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    runAsUser: 1000
    capabilities:
      drop:
      - ALL
    seccompProfile:
      type: RuntimeDefault

services:
  redis:
    local_setup: true
    image: valkey/valkey:7.2.11-alpine
    servicePort: 6379
    volumeSize: 500Mi
    pullPolicy: IfNotPresent
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  postgres:
    local_setup: true
    image: postgres:15.7-alpine
    servicePort: 5432
    volumeSize: 2Gi
    pullPolicy: IfNotPresent
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    read_replica:
      enabled: false
      remote_url: '' # INCASE OF REMOTE PG DB URL ONLY

  rabbitmq:
    local_setup: true
    image: rabbitmq:3.13.6-management-alpine
    servicePort: 5672
    managementPort: 15672
    volumeSize: 100Mi
    pullPolicy: IfNotPresent
    default_user: plane
    default_password: plane
    external_rabbitmq_url: ''
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  opensearch:
    local_setup: false
    # The OpenSearch image needs uid/gid 1000 to own its data dir. Set both to
    # null where the platform assigns them — but the image does not run under an
    # arbitrary UID either, so on OpenShift use an external OpenSearch instead
    # and leave local_setup off.
    runAsUser: 1000
    fsGroup: 1000
    image: opensearchproject/opensearch:3.3.2
    servicePort: 9200
    volumeSize: 5Gi
    pullPolicy: IfNotPresent
    username: plane
    password: Secure@Pass#123!%^&*
    memoryLimit: 3Gi
    cpuLimit: 750m
    memoryRequest: 2Gi
    cpuRequest: 500m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  minio:
    local_setup: true
    image: minio/minio:latest
    image_mc: minio/mc:latest
    init_image: busybox
    volumeSize: 3Gi
    pullPolicy: IfNotPresent
    root_user: admin
    root_password: password
    assign_cluster_ip: false
    env:
      minio_endpoint_ssl: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  iframely:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 1000m
    memoryRequest: 256Mi
    cpuRequest: 100m
    image: makeplane/iframely:v1.2.0
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  web:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/web-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  monitor:
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/monitor-commercial
    pullPolicy: Always
    volumeSize: 100Mi
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  space:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    image: makeplane/space-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  admin:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/admin-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  live:
    replicas: 1
    memoryLimit: 2000Mi
    cpuLimit: 500m
    memoryRequest: 512Mi
    cpuRequest: 100m
    image: makeplane/live-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  live_exporter:
    enabled: true
    replicas: 1
    # PDF render footprint is 500MB-2GB; default limits reflect that.
    memoryLimit: 2000Mi
    cpuLimit: 1000m
    memoryRequest: 256Mi
    cpuRequest: 100m
    image: makeplane/live-commercial
    pullPolicy: Always
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  api:
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 1000m
    memoryRequest: 512Mi
    cpuRequest: 200m
    image: makeplane/backend-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  external_api:
    enabled: false
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 1000m
    memoryRequest: 512Mi
    cpuRequest: 200m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  worker:
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 1000m
    memoryRequest: 1Gi
    cpuRequest: 200m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  worker_importers:
    enabled: false
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 1000m
    memoryRequest: 512Mi
    cpuRequest: 200m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  beatworker:
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 500m
    memoryRequest: 512Mi
    cpuRequest: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  silo:
    enabled: true
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    image: makeplane/silo-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    connectors:
      slack:
        enabled: false
        client_id: ''
        client_secret: ''
        base_url: ''
        signing_secret: ''
      github:
        enabled: false
        client_id: ''
        client_secret: ''
        app_name: ''
        app_id: ''
        private_key: ''
        webhook_secret: ''
      gitlab:
        enabled: false
        client_id: ''
        client_secret: ''
      sentry:
        enabled: false
        base_url: ''
        client_id: ''
        client_secret: ''
        integration_slug: ''
      bitbucket:
        enabled: false
        client_id: ''
        client_secret: ''
        webhook_secret: ''

      hubspot:
        enabled: false
        client_id: ''
        client_secret: ''

  email_service:
    enabled: false
    # The image's app-user is uid 100 and owns /opt/email, so this service pins
    # its own UID rather than following the shared securityContext block above.
    # Set to null where the platform assigns the UID (OpenShift restricted-v2).
    runAsUser: 100
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/email-commercial
    pullPolicy: Always
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  outbox_poller:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  automation_consumer:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  webhook_consumer:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  agent_consumer:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  integration_event_consumer:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  pi:
    enabled: false
    replicas: 1
    memoryLimit: 2Gi
    cpuLimit: 1000m
    memoryRequest: 512Mi
    cpuRequest: 200m
    image: makeplane/plane-pi-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    ai_providers:
      openai:
        enabled: false
        base_url: ''
        api_key: ''
      claude:
        enabled: false
        base_url: ''
        api_key: ''
      groq:
        enabled: false
        base_url: ''
        api_key: ''
      cohere:
        enabled: false
        base_url: ''
        api_key: ''
      custom_llm:
        enabled: false
        api_key: ''
        base_url: ''
        model_key: 'gpt-oss-120b'
        name: 'GPT-OSS-120B'
        max_tokens: 128000
        provider: ''
        aws_region: ''
      embedding_model:
        enabled: false
        name: ''
        model_id: ''
        embedding_dimension: 1536
        aws_access_key: ''
        aws_secret_access_key: ''
        aws_region: 'us-east-1'
        aws_session_token: ''

  pi_beat_worker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  pi_worker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 256Mi
    cpuRequest: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  runner:
    enabled: false
    replicas: 1
    memoryLimit: 512Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/node-runner-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

external_secrets:
  # Name of the existing Kubernetes Secret resource; see README for more details
  rabbitmq_existingSecret: ''
  pgdb_existingSecret: ''
  opensearch_existingSecret: ''
  doc_store_existingSecret: ''
  app_env_existingSecret: ''
  live_env_existingSecret: ''
  silo_env_existingSecret: ''
  pi_api_env_existingSecret: ''
  runner_env_existingSecret: ''
  # Supplies OTEL_EXPORTER_OTLP_HEADERS (collector ingestion credential) when
  # observability.otel.enabled is set; leave blank to let the chart create it.
  otel_env_existingSecret: ''

env:
  storageClass: ''

  # Kubernetes internal cluster domain used to build in-cluster service URLs
  default_cluster_domain: 'cluster.local'

  # REDIS
  remote_redis_url: '' #INCASE OF REMOTE REDIS ONLY

  # POSTGRES DB VALUES
  pgdb_username: plane
  pgdb_password: plane
  pgdb_name: plane
  pg_pi_db_name: plane_pi
  pgdb_remote_url: '' #INCASE OF REMOTE PG DB URL ONLY
  pg_pi_db_remote_url: '' #INCASE OF REMOTE Plane AI (PI) PG DB URL ONLY

  # DATA STORE
  docstore_bucket: uploads
  doc_upload_size_limit: '5242880' # 5MB

  # Storage backend selection: 'S3' (default; covers MinIO and S3-compatible
  # services) or 'GCS' (Google Cloud Storage native mode).
  storage_provider: 'S3'

  # REQUIRED IF MINIO LOCAL SETUP IS FALSE
  aws_access_key: ''
  aws_secret_access_key: ''
  aws_region: ''
  aws_s3_endpoint_url: ''

  # GCS (Google Cloud Storage) — used only when storage_provider is 'GCS'.
  # When using GCS, set use_storage_proxy: true so browser uploads are proxied
  # server-side through the API (the bucket then needs no CORS configuration).
  # Defaults to docstore_bucket when left empty.
  gcs_bucket_name: ''
  gcs_project_id: ''
  # Credentials are resolved in this order (first match wins):
  #   1. gcs_credentials_json — inline service-account JSON (stored in a Secret)
  #   2. gcs_credentials_path  — path to a service-account file you mount yourself
  #   3. neither — Application Default Credentials (e.g. GKE Workload Identity)
  gcs_credentials_json: ''
  gcs_credentials_path: ''

  use_storage_proxy: false
  allow_all_attachment_types: false
  enable_drf_spectacular: false

  #OPENSEARCH ENVS
  opensearch_remote_url: ''
  opensearch_remote_username: ''
  opensearch_remote_password: ''
  opensearch_index_prefix: ''
  opensearch_embedding_dimension: 1536

  #API KEYS
  secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5"
  api_key_rate_limit: "60/minute"

  # Gunicorn settings.
  gunicorn_workers: 1
  gunicorn_max_requests: 1000
  gunicorn_max_requests_jitter: 150

  # Celery broker settings.
  # celery_task_publish_retry: retry task publishing on transient AMQP failures instead of silently dropping.
  # celery_broker_pool_limit: bound the connection pool to prevent stale connections accumulating.
  celery_task_publish_retry: true
  celery_broker_pool_limit: 10

  sentry_dsn: ''
  sentry_environment: ''

  cors_allowed_origins: ''
  instance_admin_email: ''
  web_url: ''

  # Comma-separated list of IPs/CIDRs and hostnames that webhooks are allowed to target.
  # Leave empty to allow all (no restriction).
  webhook_allowed_ips: ''
  webhook_allowed_hosts: ''

  live_sentry_dsn: ""
  live_sentry_environment: ""
  live_sentry_traces_sample_rate: ""
  live_server_secret_key: "htbqvBJAgpm9bzvf3r4urJer0ENReatceh"

  # Background PDF/DOCX export worker queue.
  export_queue_name: "plane-exports"
  # Base URL for export download redirects. Defaults to licenseDomain with protocol from SSL settings.
  export_download_base_url: ""
  external_iframely_url: ""

  silo_envs:
    sentry_dsn: ''
    sentry_environment: ''
    sentry_traces_sample_rate: ''
    batch_size: 100
    mq_prefetch_count: 1
    request_interval: 400
    importers_queue_name: 'celery'
    hmac_secret_key: 'gzb7MRLr0FoN129NyWARZEs84P9LzQ'
    aes_secret_key: 'dsOdt7YrvxsTIFJ37pOaEVvLxN8KGBCr'
    cors_allowed_origins: ''
    jira_server_issues_page_size: 50
    jira_server_issues_parallel_pages: 1
    cursor_webhook_secret: 'TTqazTcoBajYKzIAeIKFZeTX9czAoUsG'
    # Integration event stream: normalized webhook events Silo forwards to Plane.
    integration_event_ingest_enabled: false
    integration_event_providers: "github,gitlab,slack"
    integration_event_ingest_timeout_ms: 2000

  email_service_envs:
    smtp_domain: ''
    max_attachment_size: '10485760' # 10MB in bytes

  # Shared across api / worker / beat-worker / integration-event-consumer.
  integration_event_envs:
    stream_exchange_name: "plane.integration_stream"
    max_raw_bytes: 262144
    publish_timeout: 2.0
    publish_max_retries: 2
    publish_retry_delay: 0.05
    republish_batch_size: 500
    republish_max_attempts: 10
    republish_grace_seconds: 60
    cleaner_batch_size: 1000
    cleaner_cutoff_days: 7
    collection_name: "integration_event"

  outbox_poller_envs:
    memory_limit_mb: 400
    interval_min: 0.25
    interval_max: 2
    batch_size: 250
    memory_check_interval: 30
    pool:
      size: 4
      min_size: 2
      max_size: 10
      timeout: 30.0
      max_idle: 300.0
      max_lifetime: 3600
      reconnect_timeout: 5.0
      health_check_interval: 60

  automation_consumer_envs:
    event_stream_queue_name: "plane.event_stream.automations"
    event_stream_prefetch: 10
    exchange_name: "plane.event_stream"
    event_types: "issue"

  webhook_consumer_envs:
    queue_name: "plane.webhook"
    prefetch_count: 10

  agent_consumer_envs:
    queue_name: "plane.agent"
    prefetch_count: 10

  integration_event_consumer_envs:
    queue_name: "plane.integration_stream.reference"
    prefetch_count: 10

  runner_envs:
    execution_timeout_ms: "10000"
    init_timeout_ms: "5000"
    isolate_memory_mb: "128"
    control_service_base_url: ""
    hmac_secret_key: ""

  pi_envs:
    plane_oauth:
      state_expiry_seconds: 82800
    plane_api_host: ''
    follower_postgres_uri: ''
    cors_allowed_origins: ''
    internal_secret: 'tyfvfqvBJAgpm9bzvf3r4urJer0Ehfdubk'
    log_level: 'DEBUG'

    ai_usage_agent_max_tokens_budget: ''
    ai_usage_enforcement_enabled: true

    celery:
      vector_sync_enabled: false
      vector_sync_interval: 3
      workspace_plan_sync_enabled: false
      workspace_plan_sync_interval: 86400
      docs_sync_enabled: false
      docs_sync_interval: 86400

# Global extra environment variables that will be applied to all workloads
extraEnv: []
  # - name: HTTP_PROXY
  #   value: "http://proxy.example.com:8080"
  # - name: HTTPS_PROXY
  #   value: "http://proxy.example.com:8080"
  # - name: NO_PROXY
  #   value: "localhost,127.0.0.1,.example.com"

# OpenTelemetry (traces + logs + metrics). Off by default. When enabled, a shared
# ConfigMap (<release>-otel-vars) is mounted via envFrom into the backend
# workloads (api, external-api, worker, worker-importers, beat-worker,
# automation-consumer, agent-consumer, webhook-consumer, outbox-poller, silo,
# live, live-exporter, space, pi-api, pi-beat, pi-worker), and each gets an
# inline OTEL_SERVICE_NAME so it reports its own service.name. web/admin are NOT
# wired: their only OTel is browser tracing, configured from the API's instance
# config via the frontend.* keys below — not per-workload env.
observability:
  otel:
    enabled: false
    # OTLP collector endpoint. An https:// endpoint => secure gRPC.
    endpoint: ''
    protocol: grpc
    # Extra OTLP exporter headers, "k1=v1,k2=v2" (e.g. a collector ingestion key).
    # Rendered into a Secret, not the ConfigMap — see
    # external_secrets.otel_env_existingSecret to supply it yourself instead.
    headers: ''
    # Deployment environment tag. Emitted as deployment.environment.name (the
    # CURRENT semconv key — matches the node/pi/browser services for cross-service
    # filtering). Leave blank to omit.
    environment: ''
    # Any additional resource attributes, "k1=v1,k2=v2".
    resourceAttributes: ''
    # Print spans to stdout (debug only).
    debugConsole: false
    # Trace sampler. always_on = export every span the service sees and, unlike
    # parentbased_*, does NOT defer to an upstream traceparent's sampled flag — so
    # browser-initiated POST/user-action traces aren't silently dropped (the "only
    # GET shows up" symptom). For prod use parentbased_traceidratio with a ratio
    # AND ensure browser tracing samples consistently. samplerArg is ignored by
    # always_on.
    sampler: always_on
    samplerArg: '1.0'
    # Browser/client tracing for web/admin/space — served to browsers by the API
    # (read only by the API container). Turns on when enabled AND endpoint is set.
    frontend:
      enabled: false
      # PUBLIC OTLP/HTTP endpoint the browser posts to (must be internet-reachable
      # and CORS-enabled for the Plane web origin; the client appends /v1/traces).
      endpoint: ''
      # A non-empty header is REQUIRED cross-origin: it forces the web exporter
      # onto XHR instead of navigator.sendBeacon (sendBeacon sends credentials,
      # which CORS rejects against a wildcard ACAO). Value is arbitrary.
      headers: 'x-otlp-browser=1'