# Bikoret ConfigMap — non-secret configuration
# Construction spec §4.4: Tuning constants
apiVersion: v1
kind: ConfigMap
metadata:
  name: shorashim-config
  namespace: shorashim
data:
  # L1 mount point — read-only Torah filesystem
  L1_MOUNT_POINT: "/mnt/torah"

  # Manna provision file location
  MANNA_PROVISION_FILE: "/var/lib/bikoret/manna/today.json"

  # The day's portion, written by the manna CronJob at 00:01Z Sunday to
  # Friday (manna-cronjob.yaml); Friday's is doubled and stands through
  # Shabbat. The kohen sets the amounts here (Pekudei: from the half-shekel
  # fund); a change takes effect at the next writing.
  # A Claude Code session behind the gate makes a request per tool call:
  # raised 2026-10-15 from 1000 / 500 when the gate opened to it.
  MANNA_COMPUTE_UNITS: "5000"
  MANNA_MEMORY_MB: "32768"
  MANNA_API_CALLS_EXTERNAL: "5000"
  MANNA_STORAGE_DELTA_MB: "100"
  MANNA_SANHEDRIN_PANELS_MAX: "5"

  # Talmudic Engine socket
  TALMUDIC_SOCKET_PATH: "/tmp/bikoret/talmudic.sock"

  # Korban Processor socket — the bedikah (Construction §3.9). Opened by
  # the korban-processor container, read by vav-pipeline, both over the
  # shared tmp-bikoret volume. Pod-internal; never on the network.
  KORBAN_SOCKET_PATH: "/tmp/bikoret/korban.sock"

  # Courtyard / chatzer keys — a FILE (Construction §4.6), projected from
  # the shorashim-api-keys Secret (secrets.yaml). The path is config; the
  # keys never are.
  API_KEYS_FILE: "/etc/bikoret/secrets/api_keys"

  # The pod network. The ingress controller lives in it; only from here
  # is X-Real-IP believed as the caller's address (the pe'ah's per-IP
  # watch, Tamid §1.1). Nothing outside the cluster can reach the pod
  # directly any more (service.yaml), so nothing outside can forge it.
  TRUSTED_PROXIES: "192.168.0.0/16"

  # Shoresh Engine binary — staged onto the shared shoresh-bin volume
  # by the shoresh-engine-install init container (see deployment.yaml).
  # vav_pipeline spawns it as an Erlang Port, i.e. as a child process of
  # the vav-pipeline container, so it must be a path on THIS
  # container's filesystem.
  SHORESH_ENGINE_BINARY: "/opt/shoresh/shoresh-engine"

  # Shabbat location — Zurich (Construction spec §4.4)
  SHABBAT_LATITUDE: "47.3769"
  SHABBAT_LONGITUDE: "8.5417"
  SHABBAT_TIMEZONE_OFFSET: "1"

  # Cycle boundary check interval (ms)
  CYCLE_BOUNDARY_CHECK_INTERVAL_MS: "60000"

  # Pipeline latency budget (ms) — Construction spec §2.5
  PIPELINE_LATENCY_BUDGET_MS: "5000"

  # Ecto pool size for vav-pipeline (runtime.exs default 20). The DBaaS
  # is an Aiven hobbyist-2 shared with Gitea and Aiven's own monitor;
  # a pool of 20 fills its connection ceiling by itself (2026-10-15:
  # refusals "remaining connection slots are reserved" for 24 h, one
  # pool worker looping, Aiven's monitor refused). Ten is ample for a
  # single replica.
  POOL_SIZE: "10"