Sync chart from pieced-threema-gateway 0.1.11

deploy/helm/pieced-threema-gateway/values.yaml

@@ -6,7 +6,7 @@ namespace: threema-gateway
 
 image:
   repository: registry.c5ai.ch/pieced/pieced-threema-gateway
-  tag: "0.1.10"
+  tag: "0.1.11"
   pullPolicy: IfNotPresent
 
 # Pull from registry.c5ai.ch — matches operator + portal pattern.
@@ -138,6 +138,20 @@ openclawUrlTemplate: http://openclaw.tenant-{tenant}.svc.cluster.local:18789/web
 
 forwardTimeoutMs: 8000
 
+# Per-tenant forward URLs (set via POST/PATCH /admin/tokens {forwardUrl})
+# must point at a cluster Service whose hostname matches this pattern.
+forwardUrlHostPattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?\.[a-z0-9]([-a-z0-9]*[a-z0-9])?\.svc(\.cluster\.local)?$'
+
+# Inbound media (voice notes, photos, files) for tenants with mediaEnabled.
+# Decrypted blobs are held in memory only, for ttlSeconds, until the tenant
+# plugin fetches them via GET /api/media/:id. Keep resources.limits.memory
+# comfortably above storeMaxBytes.
+media:
+  ttlSeconds: 600
+  maxInboundBytes: 26214400   # 25 MiB
+  maxOutboundBytes: 26214400  # 25 MiB
+  storeMaxBytes: 268435456    # 256 MiB
+
 logLevel: info
 
 # Resources for the relay pod
@@ -146,8 +160,9 @@ resources:
     cpu: 100m
     memory: 128Mi
   limits:
-    cpu: 500m
-    memory: 512Mi
+    cpu: "1"
+    # Media store (256 MiB) + one 25 MiB upload in flight as base64 JSON.
+    memory: 768Mi
 
 # CiliumNetworkPolicy — restricts who can talk in and out.
 networkPolicy:
@@ -159,3 +174,10 @@ networkPolicy:
   tenantNamespaceLabelValue: "pieced-operator"
   # The portal pod runs in this namespace (per apps/portal in pieced-gitops).
   portalNamespace: pieced-system
+  # Agents outside operator-managed tenant namespaces (e.g. a personal
+  # Hermes). Each entry allows that namespace to call the relay API and the
+  # relay to deliver to it on `port` (the pod's targetPort, see the note on
+  # Cilium socket-LB in templates/networkpolicy.yaml).
+  extraClients:
+    - namespace: hermes
+      port: 8650