values.base.yaml

nico-api:
  # Disable legacy forge-system namespace alias for local dev
  legacyAlias:
    enabled: false
  # Vault's local admin-CLI certificates are issued by CN=local-vault-ca.
  auth:
    additionalIssuerCns:
      - "local-vault-ca"
  resources:
    limits:
      cpu: "16"
      memory: "16Gi"
    requests:
      cpu: "1"
      memory: "1Gi"
  webAuth:
    mode: "none"
  # DevSpace does not deploy rack-manager. Do not render RMS-backed services
  # into nico-api's configuration when their backend is absent.
  componentManager:
    enabled: false
  rms:
    enabled: false
  siteConfig:
    enabled: true
    nicoApiSiteConfig: |
      attestation_enabled = false
      dpu_ipmi_tool_impl = "test"
      initial_domain_name = "local.nico"
      initial_dpu_agent_upgrade_policy = "off"
      # devspace's deployment uses machine-a-tron in single-IP mode, which
      # requires insecure discovery (where the server trusts a caller-provided
      # machine interface ID rather than inspecting the connection's source
      # IP.)
      allow_insecure_discovery = true

      # DB transactions in nico should be quick, pool size should ≈ the
      # number of cores. Default postgres configuration is a 100 connection
      # limit, so let's stay safely below that.
      max_database_connections = 64

      [pools.lo-ip]
      type = "ipv4"
      ranges = [{ start = "10.180.64.1", end = "10.180.127.254" }]

      [pools.vlan-id]
      type = "integer"
      ranges = [{ start = "100", end = "501" }]

      [pools.vni]
      type = "integer"
      ranges = [{ start = "1024500", end = "1024550" }]

      [pools.vpc-vni]
      type = "integer"
      ranges = [{ start = "2024500", end = "2024550" }]

      [pools.fnn-asn]
      type = "integer"
      ranges = [{ start = "1000", end = "10000" }]

      [networks.admin]
      type = "admin"
      prefix = "192.168.64.0/18"
      gateway = "192.168.64.1"
      mtu = 9000
      reserve_first = 2

      [networks.DEV-K3S-DPU-ACORN-0]
      type = "underlay"
      prefix = "192.168.128.0/18"
      gateway = "192.168.128.1"
      mtu = 1500
      reserve_first = 2

      [networks.DEV-K3S-X86-BMC-UNDERLAY-ACORN-X86-0]
      type = "underlay"
      prefix = "192.168.192.0/18"
      gateway = "192.168.192.1"
      mtu = 1500
      reserve_first = 2

      [auth]
      permissive_mode = true

      [auth.trust]
      spiffe_trust_domain = "nico.local"
      spiffe_service_base_paths = ["/nico-system/sa/", "/default/sa/"]
      spiffe_machine_base_path = "/nico-system/machine/"
      additional_issuer_cns = ["local-vault-ca"]

      [host_health]
      hardware_health_reports = "MonitorOnly"

      [machine_state_controller]
      dpu_wait_time = "1s"
      skip_polling_checks = true

      [machine_state_controller.controller]
      iteration_time = "30s"
      max_concurrency = 100

      [vpc_prefix_state_controller]
      vpc_prefix_drain_time = "5m"

      [machine_validation_config]
      enabled = false

      [site_explorer]
      enabled = true
      create_machines = true
      allow_changing_bmc_proxy = true
      bmc_proxy = "nico-machine-a-tron-mat-0-bmc-mock.nico-system.svc.cluster.local:1266"
      run_interval = "10s"
      machines_created_per_run = 1000
      explorations_per_run = 1000
      concurrent_explorations = 100
      explore_mode = "nv-redfish"

      [firmware_global]
      autoupdate = true
      run_interval = "10s"
      concurrency_limit = 100

nico-bmc-proxy:
  enabled: true
  replicas: 1 # save on local resources
  configFiles:
    enabled: true
    nicoBmcProxyConfig: |
      listen = "[::]:1079"
      metrics_endpoint = "[::]:1080"
      database_url = "postgres://replaced-by-env-var"
      allowed_principals = ["trusted-certificate"]
      bmc_proxy = "nico-machine-a-tron-mat-0-bmc-mock.nico-system.svc.cluster.local:1266"

      [tls]
      identity_pemfile_path = "/var/run/secrets/spiffe.io/tls.crt"
      identity_keyfile_path = "/var/run/secrets/spiffe.io/tls.key"
      root_cafile_path = "/var/run/secrets/spiffe.io/ca.crt"
      admin_root_cafile_path = "/etc/forge/carbide-bmc-proxy/site/admin_root_cert_pem"

      [auth.trust]
      spiffe_trust_domain = "nico.local"
      spiffe_service_base_paths = [
        "/nico-system/sa/",
        "/default/sa/",
      ]
      spiffe_machine_base_path = "/nico-system/machine/"
      additional_issuer_cns = ["local-vault-ca"]

      [auth.acls]
      "trusted-certificate" = ["/**"]

      [carbide_api]
      api_url = "https://nico-api.nico-system.svc.cluster.local:1079"
      root_ca = "/var/run/secrets/spiffe.io/ca.crt"
      client_cert = "/var/run/secrets/spiffe.io/tls.crt"
      client_key = "/var/run/secrets/spiffe.io/tls.key"

nico-machine-a-tron:
  enabled: true
  # Deploy to nico-system (same namespace as nico-api) for simpler dev setup
  # No need to copy secrets or configure cross-namespace access
  machineATron:
    nicoApiUrl: "https://nico-api.nico-system.svc.cluster.local:1079"
  # Preserve simulated machine identity and installed OS across pod restarts.
  # Without this, Core can remain in an Assigned state while a restarted
  # machine-a-tron has reset the corresponding host and DPUs to MachineDown.
  persistence:
    enabled: true
  # SPIFFE URI must match nico-api's allowed service_base_paths
  certificate:
    uris:
      - "spiffe://nico.local/nico-system/sa/machine-a-tron"
  pods:
    mat-0:
      machines:
        rack-machines:
          hwType: wiwynn_gb200_nvl
          hostCount: 2
          dpuPerHostCount: 2
          oobDhcpRelayAddress: "192.168.192.1"
          adminDhcpRelayAddress: "192.168.176.1"
nico-dhcp:
  enabled: false
nico-dns:
  enabled: false
nico-dsx-exchange-consumer:
  enabled: false
nico-hardware-health:
  enabled: false
nico-pxe:
  enabled: false
nico-ssh-console-rs:
  enabled: false
unbound:
  enabled: false