variable "queue_prefix" {
  description = "Prefix for queue names"
  type        = string
  default     = "deepchecks"
}

locals {
  queues = {
    insights-calculator = {
      visibility_timeout = 360
      fifo               = true
      max_receive_count  = 3
    }
    garak-props-calculator = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    props-calc-batcher = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    translation = {
      visibility_timeout = 660
      fifo               = false
      max_receive_count  = 3
    }
    pre-calc-eng = {
      visibility_timeout = 660
      fifo               = false
      max_receive_count  = 3
    }
    advanced-llm-prop-calculator = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    calibrator = {
      visibility_timeout = 360
      fifo               = true
      max_receive_count  = 3
    }
    notifier = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    proba-calculator = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    llm-properties = {
      visibility_timeout = 660
      fifo               = false
      max_receive_count  = 3
    }
    topics-inference = {
      visibility_timeout = 660
      fifo               = false
      max_receive_count  = 3
    }
    topics-train = {
      visibility_timeout = 660
      fifo               = true
      max_receive_count  = 3
    }
    similarity-annotations = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    properties-calculator = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
    estimate-annotation-calculator = {
      visibility_timeout = 360
      fifo               = false
      max_receive_count  = 3
    }
  }
}

# Dead Letter Queues
resource "aws_sqs_queue" "dlq" {
  for_each = local.queues

  name                        = "${var.queue_prefix}-${each.key}-dlq${each.value.fifo ? ".fifo" : ""}"
  fifo_queue                  = each.value.fifo
  visibility_timeout_seconds  = each.value.visibility_timeout
  content_based_deduplication = each.value.fifo ? true : false
}

# Main Queues
resource "aws_sqs_queue" "queue" {
  for_each = local.queues

  name                        = "${var.queue_prefix}-${each.key}${each.value.fifo ? ".fifo" : ""}"
  fifo_queue                  = each.value.fifo
  visibility_timeout_seconds  = each.value.visibility_timeout
  content_based_deduplication = each.value.fifo ? true : false

  redrive_policy = jsonencode({
    deadLetterTargetArn = aws_sqs_queue.dlq[each.key].arn
    maxReceiveCount     = each.value.max_receive_count
  })
}

nodeSelector:
  role: gpu
affinity: null

tolerations:
  - key: CriticalAddonsOnly
    operator: Exists
  - key: nvidia.com/gpu
    operator: Exists

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:Get*",
        "s3:List*",
        "s3:Put*",
        "s3:Delete*"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::<BUCKET_NAME>",
        "arn:aws:s3:::<BUCKET_NAME>/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl"
      ],
      "Resource": "arn:aws:sqs:REGION:ACCOUNT_ID:<TENANT_NAME>*"
    },
    {
      "Action": [
        "bedrock:InvokeModel"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

# Default values for deepchecks-llm-stack.
# This is a YAML-formatted file.

global:
  image:
    repository: harbor.llmdev.deepchecks.com/deepchecks/llm
    # This sets the pull policy for images.
    pullPolicy: IfNotPresent
    # Image tag; defaults to Chart.appVersion if empty
    tag: ""
  # Pull secrets for private container registries
  imagePullSecrets: []
  # Environment variables passed to all pods via ConfigMap
  env: {}
  # Number of old ReplicaSets to retain for rollback
  revisionHistoryLimit: 3

serviceAccount:
  # Create a shared ServiceAccount for all components
  create: true
  # Mount API credentials into pods
  automount: true
  # Annotations for cloud provider integrations (e.g., IAM roles)
  annotations: {}

web:
  # Number of web server replicas
  replicaCount: 1
  # Override the chart name
  nameOverride: ""
  fullnameOverride: ""

  # Pod annotations for monitoring, logging, or mesh integration
  podAnnotations: {}
  # Additional labels for pods
  podLabels: {}

  # Pod-level security settings (fsGroup, runAsUser, etc.)
  podSecurityContext: {}
    # fsGroup: 2000

  # Container-level security settings
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # CPU and memory requests/limits
  resources:
    requests:
      cpu: 2000m
      memory: 8Gi

  autoscaling:
    # Enable Horizontal Pod Autoscaler
    enabled: false
    minReplicas: 1
    maxReplicas: 10
    # Target CPU percentage for scaling
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  # Additional volumes for the deployment
  volumes: []
  # Additional volume mounts for containers
  volumeMounts: []

  # Node selector for pod scheduling
  nodeSelector: {}
  # Tolerations for node taints
  tolerations: []
  # Affinity rules for pod placement
  affinity: {}

  service:
    # Service type: ClusterIP, NodePort, or LoadBalancer
    type: ClusterIP
    # Port the service exposes
    port: 8000

  ingress:
    # Enable ingress resource creation
    enabled: true
    # Ingress controller class (e.g., nginx, kong, traefik)
    className: ""
    # Ingress annotations for TLS, auth, rate-limiting, etc.
    annotations: {}
    # Hostname for the application (required if ingress enabled)
    host: ""
    # TLS configuration
    tls: []

# Default configuration inherited by all workers
workerDefaults: &workerDefaults
  replicaCount: 1
  nameOverride: ""
  fullnameOverride: ""
  podAnnotations: {}
  podLabels: {}
  podSecurityContext: {}
  securityContext: {}
  resources:
    limits:
      cpu: 1000m
      memory: 6Gi
    requests:
      cpu: 1000m
      memory: 6Gi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 10
    targetCPUUtilizationPercentage: 80
  nodeSelector: {}
  tolerations: []
  affinity: {}

# Background worker deployments
workers:
  # Computes advanced LLM properties
  advanced-llm-prop-calculator:
    <<: *workerDefaults
    init: advanced_llm_props_runner

  # Handles batch processing jobs
  batcher-runner:
    <<: *workerDefaults
    init: batcher_runner

  # Runs calibration logic
  dc-calibrator:
    <<: *workerDefaults
    init: dc_calibrator

  # Calculates probability scores
  dc-proba-calculator:
    <<: *workerDefaults
    init: dc_proba_calculator

  # Estimates annotations
  estimate-annotation-calculator:
    <<: *workerDefaults
    init: estimate_annotation_runner

  # Runs Garak security property checks
  garak-props-runner:
    <<: *workerDefaults
    init: garak_props_runner

  # GPU-accelerated processing (requires GPU nodes)
  gpu-runner:
    <<: *workerDefaults
    init: gpu_runner

  # Generates insights from analysis
  insights-runner:
    <<: *workerDefaults
    init: insights_runner

  # Computes LLM properties
  llm-properties-calculator:
    <<: *workerDefaults
    init: llm_props

  # Sends notifications
  notifier:
    <<: *workerDefaults
    init: notifier

  # Pre-calculation engine
  pre-calc-eng:
    <<: *workerDefaults
    init: pre_calc_eng

  # Handles data transformation
  translator:
    <<: *workerDefaults
    init: translator

serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::12345567890:role/DeepchecksRole

global:
  image:
    tag: "0.39.2"

  # supplied here is the secret containing the username and password needed to pull the Deepchecks containers
  imagePullSecrets:
    - name: deepchecks-registry
  env:
    CREATE_ORG_FOR_USER: "[email protected]"
    TENANT_NAME: "example"
    GENERAL.MODELS_BUCKET_NAME: "deepchecks-models"
    LOGGER.LEVEL_DEEPCHECKS_LLM: "INFO"
    REDIS.HOST: "host.redis.com"
    REDIS.PORT: "10000"
    LOGGER.FORMATTER: "TEXT"
    GENERAL.IGNORE_EMAIL_VERIFICATION: "True"

# in this example kong is used as the ingress controller along with cert manager for certificate management
web:
  ingress:
    enabled: true
    className: "kong"
    annotations:
      cert-manager.io/cluster-issuer: issuer
    host: deepchecks.example.com
    tls:
      - hosts:
          - deepchecks.example.com
        secretName: deepchecks-tls

workers:
  # it is important to configure your node selectors and taints in order to ensure that your GPU workers run on your GPU powered nodes
  gpu-runner:
    nodeSelector:
      role: gpu
    tolerations:
      - effect: NoSchedule
        key: nvidia.com/gpu
        operator: Exists