# Exercises: existingClaim, existingSecret (auth + gpg), metrics + ServiceMonitor,
# networkPolicy, PDB, declarative state (gpgKeys/localRepos/mirrors/publish),
# configOverrides passthrough, extra* escape hatches.
persistence:
  existingClaim: my-existing-pvc

security:
  preset: authenticated
  auth:
    existingSecret: my-htpasswd-secret
  trustedProxies: ["10.0.0.0/8"]
  write:
    allowCIDRs: ["10.42.0.0/16"]

aptly:
  architectures: [amd64, arm64]
  metrics:
    enabled: true
  gpg:
    signingKey:
      existingSecret: my-signing-key-secret
  gpgKeys:
    - name: debian-archive
      armored: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        dGVzdA==
        -----END PGP PUBLIC KEY BLOCK-----
  localRepos:
    - name: stable
      comment: "Production repo"
      defaultDistribution: stable
      defaultComponent: main
  mirrors:
    - name: debian-security
      archiveURL: http://security.debian.org/debian-security
      distribution: trixie-security
      components: [main]
      architectures: [amd64, arm64]
  publish:
    - name: stable-root
      prefix: ""
      distribution: stable
      sourceKind: local
      sources: [{ name: stable, component: main }]
      architectures: [amd64, arm64]
      acquireByHash: true
  configOverrides:
    download_concurrency: 8
  existingSecretEnv: ["some-other-secret"]

metrics:
  service:
    enabled: true
  serviceMonitor:
    enabled: true

networkPolicy:
  enabled: true
  allowedNamespaces: ["ci", "monitoring"]

podDisruptionBudget:
  enabled: true
  maxUnavailable: 1

reconcile:
  mode: job

extraEnv:
  - name: FOO
    value: bar
extraVolumes:
  - name: extra
    emptyDir: {}
extraVolumeMounts:
  - name: extra
    mountPath: /extra
nodeSelector:
  kubernetes.io/os: linux
tolerations:
  - key: "example"
    operator: "Exists"
priorityClassName: "high-priority"