image:
  repository: spx01/blocky
  tag: v0.23@sha256:24855b63986c790093554a1f62b58379a06bc10a90ee073906e7c39bf692adcc
  pullPolicy: IfNotPresent
k8sgatewayImage:
  repository: quay.io/oriedge/k8s_gateway
  pullPolicy: IfNotPresent
  tag: v0.4.0@sha256:7bdbd447c0244b8f89de9cd6f4826ed0ac66c9406fac3a4ac80081020c251c6b

workload:
  main:
    replicas: 2
    strategy: RollingUpdate
    podSpec:
      containers:
        main:
          probes:
            liveness:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
            readiness:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
            startup:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
# -- Blocky Config File content
blockyConfig: {}
# upstream:
#   default:
#     - 1.1.1.1

# -- some general blocky settings
blocky:
  # -- Enable prometheus annotations
  enablePrometheus: true
service:
  main:
    enabled: true
    ports:
      main:
        enabled: true
        port: 4000
        protocol: http
        targetPort: 4000
  dns:
    enabled: true
    ports:
      dns:
        enabled: true
        port: 53
        protocol: udp
        targetPort: 53
      dnstcp:
        enabled: true
        protocol: tcp
        port: "{{ .Values.service.dns.ports.dns.port }}"
        targetPort: 53
  dot:
    enabled: true
    ports:
      dot:
        enabled: true
        port: 853
        protocol: tcp
        targetPort: 853
  https:
    enabled: true
    ports:
      https:
        enabled: true
        port: 4443
        protocol: https
        targetPort: 4443
  k8sgateway:
    enabled: true
    ports:
      k8sgateway:
        enabled: true
        port: 5353
        protocol: udp
        targetPort: 5353
## TODO Add support for SCALE certificates and certificates secrets here
certFile: ""
keyFile: ""
logLevel: info
logFormat: text
logTimestamp: true
logPrivacy: false
dohUserAgent: ""
minTlsServeVersion: 1.2
# -- set the default DNS upstream servers
# Primarily designed for inclusion in the TrueNAS SCALE GUI
defaultUpstreams:
  - 1.1.1.1
  - 1.0.0.1
  - 8.8.8.8
  - 8.8.4.4
  - 9.9.9.9
  - 149.112.112.112
  - 208.67.222.222
  - 208.67.220.220
  - 8.26.56.26
  - 8.20.247.20
  - 185.228.168.9
  - 185.228.169.9
  - 76.76.19.19
  - 76.223.122.150
  - 76.76.2.0
  - 76.76.10.0
# -- set additional upstreams
# Primarily designed for inclusion in the TrueNAS SCALE GUI
upstreams:
#  - name: group2
#    dnsservers:
#      - 1.1.1.1

# -- set bootstrap dns (not needed)
# Ensures bootstrap encryption and ensure it doesn't use k8s dns
bootstrapDns:
  # -- Upstream
  upstream: ""
  # -- IP's linked to upstream DoT/DoH DNS name
  ips: []
# -- set additional bootstrap dns (not needed, only used if bootstrapDns is set)
additionalBootstrapDns: []
# - upstream: ""
#   ips: []

# -- Return empty answer for these queries
filtering:
  # -- Ensures filtering by query type
  queryTypes: []
# -- Set manual custom DNS resolution
customDNS:
  customTTL: 1h
  filterUnmappedTypes: true
  rewrite: []
  # - in: something.com
  #   out: somethingelse.com
  mapping: []
  # - domain: something.com
  #   dnsserver: 192.168.178.1
# -- Setup client-name lookup
clientLookup:
  # -- upstream used for client-name lookup
  upstream: ""
  singleNameOrder: []
  clients:
  # - domain: laptop
  #   ips: []
# -- Setup caching
caching:
  minTime: 5m
  maxTime: 30m
  maxItemsCount: 0
  prefetching: false
  prefetchExpires: 2h
  prefetchThreshold: 5
  prefetchMaxItemsCount: 0
  cacheTimeNegative: 30m
# -- set conditional settings
# Primarily designed for inclusion in the TrueNAS SCALE GUI
conditional:
  rewrite: []
  # - in: something.com
  #   out: somethingelse.com
  mapping: []
  # - domain: something.com
  #   dnsserver: 192.168.178.1
# -- set blocking settings using Lists
# Primarily designed for inclusion in the TrueNAS SCALE GUI
blocking:
  # -- Sets the blocktype
  blockType: nxDomain
  # -- Sets the block ttl
  blockTTL: 6h
  # -- Sets the block refreshPeriod
  refreshPeriod: 4h
  # -- Sets the block download timeout
  downloadTimeout: 60s
  # -- Sets the block download attempt count
  downloadAttempts: 3
  # -- Sets the block download cooldown
  downloadCooldown: 2s
  # -- Set the start strategy (blocking | failOnError | fast)
  startStrategy: blocking
  # -- Sets how many list-groups can be processed at the same time
  processingConcurrency: 4
  # --  Add blocky whitelists
  whitelist: []
  #  - name: ads
  #    lists:
  #      - https://someurl.com/list.txt
  #      - /somefile.txt

  # -- Blocky blacklists
  blacklist: []
  # - name: ads
  #   lists:
  #     - https://someurl.com/list.txt
  #     - /somefile.txt

  # -- Blocky clientGroupsBlock
  clientGroupsBlock: []
  # - name: default
  #   groups:
  #     - ads
# -- configure using hostsfile for lookups
# Allows for using the hosts configured in kubernetes and such
hostsFile:
  enabled: false
  filePath: /etc/hosts
  hostsTTL: 60m
  refreshPeriod: 30m
## TODO: add this with postgresql support as well
# queryLog:
#   type: csv
#   target: /logs
#   logRetentionDays: 0
#   creationAttempts: 3
#   CreationCooldown: 2
podOptions:
  automountServiceAccountToken: true
portal:
  open:
    enabled: false
serviceAccount:
  main:
    # -- Specifies whether a service account should be created
    enabled: true
    primary: true
# -- Create a ClusterRole and ClusterRoleBinding
# @default -- See below
rbac:
  main:
    # -- Enables or disables the ClusterRole and ClusterRoleBinding
    enabled: true
    primary: true
    clusterWide: true
    # -- Set Rules on the ClusterRole
    rules:
      - apiGroups:
          - ""
        resources:
          - services
          - namespaces
        verbs:
          - list
          - watch
      - apiGroups:
          - extensions
          - networking.k8s.io
        resources:
          - ingresses
        verbs:
          - list
          - watch
k8sgateway:
  enabled: true
  # -- TTL for non-apex responses (in seconds)
  ttl: 300
  # -- Limit what kind of resources to watch, e.g. watchedResources: ["Ingress"]
  watchedResources: []
  # -- Service name of a secondary DNS server (should be `serviceName.namespace`)
  secondary: ""
  # -- Override the default `serviceName.namespace` domain apex
  apex: ""
  # -- list of processed domains
  domains: []
  # -- Delegated domain
  # - domain: "example.com"
  #   # -- Optional configuration option for DNS01 challenge that will redirect all acme
  #   # challenge requests to external cloud domain (e.g. managed by cert-manager)
  #   # See: https://cert-manager.io/docs/configuration/acme/dns01/
  #   dnsChallenge:
  #     enabled: false
  #     domain: dns01.clouddns.com

  forward:
    enabled: false
    primary: tls://1.1.1.1
    secondary: tls://1.0.0.1
    options:
      - name: tls_servername
        value: cloudflare-dns.com

configmap:
  dashboard:
    enabled: true
    labels:
      grafana_dashboard: "1"
    data:
      blocky.json: >-
        {{ .Files.Get "dashboard.json" | indent 8 }}
      blockypostgres.json: >-
        {{ .Files.Get "dashboardpsql.json" | indent 8 }}
  datasource:
    enabled: true
    labels:
      grafana_datasources: "1"
    data:
      datasourceblockypsql.yaml: |-
        apiVersion: 1
        datasources:
        - name: BlockyPostgres
          type: postgres
          uid: blockypostgres
          url: {{ printf "%s.%s:5432" (.Values.cnpg.main.creds.host | trimAll "\"") .Release.Namespace }}
          access: proxy
          user: {{ .Values.cnpg.main.user }}
          secureJsonData:
            password: {{ .Values.cnpg.main.creds.password | default "na" }}
          jsonData:
            database: {{ .Values.cnpg.main.database }}
            sslmode: 'disable' # disable/require/verify-ca/verify-full
            maxOpenConns: 100 # Grafana v5.4+
            maxIdleConns: 100 # Grafana v5.4+
            maxIdleConnsAuto: true # Grafana v9.5.1+
            connMaxLifetime: 14400 # Grafana v5.4+
            postgresVersion: 1500 # 903=9.3, 904=9.4, 905=9.5, 906=9.6, 1000=10
            timescaledb: false

metrics:
  main:
    # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
    # @default -- See values.yaml
    enabled: true
    type: "servicemonitor"
    endpoints:
      - port: main
        path: /metrics
    # -- Enable and configure Prometheus Rules for the chart under this key.
    # @default -- See values.yaml
    prometheusRule:
      enabled: false
      labels: {}
      # -- Configure additionial rules for the chart under this key.
      # @default -- See prometheusrules.yaml
      rules: []
      # - alert: UnifiPollerAbsent
      #   annotations:
      #     description: Unifi Poller has disappeared from Prometheus service discovery.
      #     summary: Unifi Poller is down.
      #   expr: |
      #     absent(up{job=~".*unifi-poller.*"} == 1)
      #   for: 5m
      #   labels:
      #     severity: critical

redis:
  enabled: true
# CANNOT be defined in above yaml section
queryLog:
  # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
  type: "postgresql"
  # directory (should be mounted as volume in docker) for csv, db connection string for mysql, ignored for included postgresql
  # target: /var/log/something
  # postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
  # if > 0, deletes log files which are older than ... days
  logRetentionDays: 0
  # optional: Max attempts to create specific query log writer, default: 3
  creationAttempts: 3
  # optional: Time between the creation attempts, default: 2s
  creationCooldown: 2s

cnpg:
  main:
    enabled: true
    user: blocky
    database: blocky