GCP

# Pin the Onyx version. The chart default is "latest".
global:
  version: "<Onyx version, for example v4.8.1>"

# Run all Onyx pods as the service account that has the bucket grant.
serviceAccount:
  create: false
  name: onyx-workload-access

postgresql:
  enabled: false
redis:
  enabled: false
objectStore:
  enabled: false
minio:
  enabled: false

configMap:
  # Cloud SQL
  POSTGRES_HOST: "<postgres_host>"
  POSTGRES_PORT: "5432"
  POSTGRES_DB: "onyx"            # postgres_db_name. Without it, Onyx uses the "postgres" database.
  # Memorystore
  REDIS_HOST: "<redis_host>"
  REDIS_PORT: "6378"             # redis_port. 6378 is the TLS port.
  # Cloud Storage
  FILE_STORE_BACKEND: "gcs"
  GCS_FILE_STORE_BUCKET_NAME: "<gcs_bucket_name>"
  GCS_PROJECT_ID: "<gcs_project_id>"
  # The address that users open. Links and login redirects use it.
  WEB_DOMAIN: "https://onyx.example.com"

auth:
  postgresql:
    existingSecret: "onyx-postgresql"   # Keys: username, password
  redis:
    existingSecret: "onyx-redis"        # Key: redis_password
  opensearch:
    existingSecret: "onyx-opensearch"   # Keys: opensearch_admin_username, opensearch_admin_password
  userauth:
    enabled: true
    existingSecret: "onyx-userauth"     # Key: user_auth_secret
  # Cloud Storage uses Workload Identity, so Onyx needs no S3 keys.
  objectstorage:
    enabled: false

# Sets REDIS_SSL=true and verifies the Memorystore certificate.
redisTls:
  enabled: true
  caConfigMapName: onyx-redis-ca
  caKey: ca.crt

# Optional. Verifies the Cloud SQL certificate. See the warning in the previous step.
# postgresTls:
#   enabled: true
#   sslMode: verify-ca
#   caConfigMapName: onyx-postgres-ca
#   caKey: ca.crt

# Run OpenSearch on the tainted document index pool.
opensearch:
  nodeSelector:
    onyx.app/workload: document-index
  tolerations:
    - key: document-index
      operator: Equal
      value: "true"
      effect: NoSchedule

module "onyx" {
  # ...
  enable_l7_ingress = true
  l7_domains        = ["onyx.example.com"]
}

output "l7_ip_address" {
  value = module.onyx.l7_ip_address
}

output "l7_address_name" {
  value = module.onyx.l7_address_name
}

output "l7_certificate_map_name" {
  value = module.onyx.l7_certificate_map_name
}

output "l7_dns_authorization_records" {
  value = module.onyx.l7_dns_authorization_records
}

output "l7_certificate_names" {
  value = module.onyx.l7_certificate_names
}

output "cloud_armor_policy_name" {
  value = module.onyx.cloud_armor_policy_name
}

# A dedicated Service for the Gateway. Only one GCPBackendPolicy can attach to
# a Service, and the chart's own nginx Service changes type in a later step.
apiVersion: v1
kind: Service
metadata:
  name: onyx-nginx-l7
  namespace: onyx
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: nginx
    app.kubernetes.io/instance: onyx   # the Helm release name
    app.kubernetes.io/component: controller
  ports:
    - name: http
      port: 80
      targetPort: 1024
      protocol: TCP
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: onyx
  namespace: onyx
  annotations:
    networking.gke.io/certmap: <l7_certificate_map_name>
spec:
  gatewayClassName: gke-l7-global-external-managed
  addresses:
    - type: NamedAddress
      value: <l7_address_name>
  listeners:
    # No tls block: the certificate map annotation supplies the certificates.
    - name: https
      protocol: HTTPS
      port: 443
    - name: http
      protocol: HTTP
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: onyx-https
  namespace: onyx
spec:
  parentRefs:
    - name: onyx
      sectionName: https
  hostnames:
    - onyx.example.com   # every l7_domains entry
  rules:
    - backendRefs:
        - name: onyx-nginx-l7
          port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: onyx-http-redirect
  namespace: onyx
spec:
  parentRefs:
    - name: onyx
      sectionName: http
  hostnames:
    - onyx.example.com
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
---
# The load balancer probes the pod on 1024 directly. The default probe path
# is "/", which proxies to the web server; /nginx-health answers in nginx.
apiVersion: networking.gke.io/v1
kind: HealthCheckPolicy
metadata:
  name: onyx-nginx-l7
  namespace: onyx
spec:
  default:
    config:
      type: HTTP
      httpHealthCheck:
        portSpecification: USE_FIXED_PORT
        port: 1024
        requestPath: /nginx-health
  targetRef:
    group: ""
    kind: Service
    name: onyx-nginx-l7
---
apiVersion: networking.gke.io/v1
kind: GCPBackendPolicy
metadata:
  name: onyx-nginx-l7
  namespace: onyx
spec:
  default:
    securityPolicy: <cloud_armor_policy_name>
    # The load balancer counts the whole response, not the idle time as nginx
    # does. Chat and deep research stream for many minutes.
    timeoutSec: 3600
    # Cloud Armor writes its decisions to these logs. A GCPBackendPolicy with
    # no logging section turns them off.
    logging:
      enabled: true
      sampleRate: 1000000
  targetRef:
    group: ""
    kind: Service
    name: onyx-nginx-l7

configMap:
  WEB_DOMAIN: "https://onyx.example.com"

nginx:
  controller:
    service:
      type: ClusterIP

ingress:
  enabled: false

letsencrypt:
  enabled: false

WEB_DOMAIN=<YOUR_DOMAIN>  # Something like "onyx.app"

# If your email is something like "chris@onyx.app", then this should be "onyx.app"
# This prevents people outside your company from creating an account
VALID_EMAIL_DOMAINS=<YOUR_COMPANIES_EMAIL_DOMAIN>

DOMAIN=<YOUR_DOMAIN>  # Something like "onyx.app"