fix(helm): review round — whitelabeled realtime HPA opt-out, external-db isolation on with required CIDR in install flow

- values-whitelabeled now actually sets autoscaling.realtime.enabled: false
  (the earlier batch aborted before reaching this file — Cursor caught it)
- external-db keeps networkPolicy enabled (no isolation regression); the DB
  egress CIDR is marked REQUIRED and wired into both documented install
  commands via --set, so the copy-paste flow sets the real subnet in the same
  breath as the DB host

Author: waleedlatif1

helm/sim/examples/values-external-db.yaml

@@ -19,6 +19,7 @@
 #     --set externalDatabase.username=simstudio_user \
 #     --set externalDatabase.password="$DB_PASSWORD" \
 #     --set externalDatabase.database=simstudio_prod \
+#     --set "networkPolicy.egress[0].to[0].ipBlock.cidr=<YOUR_DB_CIDR>" \
 #     --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
 #     --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
 #     --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET"
@@ -170,20 +171,18 @@ monitoring:
     interval: 15s
 
 networkPolicy:
-  # Disabled by default so a verbatim install can always reach your database.
-  # To opt into network isolation: replace the placeholder CIDR below with your
-  # database's subnet (or /32 host) FIRST, then set enabled: true — with the
-  # policy on, the chart's egress allowlist only covers the in-cluster Postgres,
-  # so an external DB on 5432 is unreachable without this rule, and a wrong
-  # CIDR blocks migrations and all database connections.
-  enabled: false
-  # `networkPolicy.egress` is a LIST of NetworkPolicy egress rules. Scope `to`
-  # to your database — an empty `to:` would allow the pods to reach ANY host
-  # on 5432, defeating the isolation this teaches.
+  enabled: true
+  # `networkPolicy.egress` is a LIST of NetworkPolicy egress rules. With the
+  # policy on, the chart's egress allowlist only covers the in-cluster
+  # Postgres, so this rule is what lets the pods reach your external database.
+  # The CIDR is a placeholder: REQUIRED — set your database's subnet (or /32
+  # host) via the --set line in the install commands below (or edit it here).
+  # A wrong CIDR blocks migrations and every database connection; an empty
+  # `to:` would allow ANY host on 5432 and defeat the isolation.
   egress:
     - to:
         - ipBlock:
-            cidr: 10.0.0.0/16 # REPLACE with your database subnet or /32 host CIDR
+            cidr: 10.0.0.0/16 # REQUIRED - your database subnet or /32 host CIDR
       ports:
         - protocol: TCP
           port: 5432
@@ -195,6 +194,7 @@ networkPolicy:
 #   --set externalDatabase.username="your-db-user" \
 #   --set externalDatabase.password="your-db-password" \
 #   --set externalDatabase.database="your-db-name" \
+#   --set "networkPolicy.egress[0].to[0].ipBlock.cidr=<YOUR_DB_CIDR>" \
 #   --set app.env.BETTER_AUTH_SECRET="$(openssl rand -hex 32)" \
 #   --set app.env.ENCRYPTION_KEY="$(openssl rand -hex 32)" \
 #   --set app.env.INTERNAL_API_SECRET="$(openssl rand -hex 32)" \

helm/sim/examples/values-whitelabeled.yaml

@@ -98,11 +98,13 @@ ingress:
     secretName: "sim-acme-tls"
 
 # Auto-scaling
-# NOTE: autoscaling also renders an HPA for realtime with the same minReplicas,
-# overriding realtime.replicaCount. Multi-replica realtime REQUIRES REDIS_URL in
-# app.env (Socket.IO Redis adapter) or cross-pod collaboration events are lost.
 autoscaling:
   enabled: true
+  # Keep realtime out of the HPA until REDIS_URL is set (Socket.IO Redis
+  # adapter) — multi-replica realtime without Redis silently drops cross-pod
+  # collaboration events.
+  realtime:
+    enabled: false
   minReplicas: 2
   maxReplicas: 10
   targetCPUUtilizationPercentage: 70