# for more options on the deployment of this chart, see:
# https://artifacthub.io/packages/helm/bitnami/keycloak
keycloak:

  # for development, use a local PostgreSQL instance.
  {% if keycloak.production %}
  postgresql:
    enabled: false

  # TODO v5+ set these variables from the CLI
  externalDatabase:
    host: "sql.example.vantage6.ai"
    port: 5432
    username: my-username
    password: my-secret-password
    database: my-keycloak-database
    schema: public
    existingSecretHostKey: my-secret-contains-the-host
    existingSecretPortKey: my-secret-contains-the-port
    existingSecretUsernameKey: my-secret-contains-the-username
    existingSecretPasswordKey: my-secret-contains-the-password
    existingSecretDatabaseKey: my-secret-contains-the-database

  # TODO v5+ set secrets in CLI
  auth:
    # Set the username and password for the Keycloak admin. This user is created when
    # the service is initialized.
    adminUser: {{ keycloak.adminUser | default('admin') }}
    existingSecret: secret-containing-admin-password
    passwordSecretKey: key-to-admin-password-in-secret
    # For a development environment, you can set the admin user and password directly.
    # adminPassword: admin

  # for production, TLS should be enabled for internal Keycloak communication
  # TODO v5+ we should test if this works when we have CLI commands (#1923)
  production: true
  tls:
    enabled: true
    autoGenerated: true
  {% else %}
  postgresql:
    enabled: true
    auth:
      postgresPassword: postgres
      password: keycloak
      database: keycloak

  # for production, use an external PostgreSQL instance. This requires setting up config
  # as follows. Be sure to set postgres.enabled to false just above here.
  # externalDatabase:
  #   host: "sql.example.vantage6.ai"
  #   port: 5432
  #   username: my-username
  #   password: my-secret-password
  #   database: my-keycloak-database
  #   schema: public
  #   # or alternatively, use secrets for all of the above formatted as:
  #   existingSecretHostKey: my-secret-contains-the-host
  #   existingSecretPortKey: my-secret-contains-the-port
  #   existingSecretUsernameKey: my-secret-contains-the-username
  #   existingSecretPasswordKey: my-secret-contains-the-password
  #   existingSecretDatabaseKey: my-secret-contains-the-database

  auth:
    # for development environment, set a dummy password for the admin user.
    adminUser: admin
    adminPassword: admin
    # for production, the password should be stored in a secret. Below you should then
    # give the name of the secret and the key to where the password is within the
    # secret.
    # existingSecret: secret-containing-admin-password
    # passwordSecretKey: key-to-admin-password-in-secret

  # if you want to switch to production, you should set the following settings to true.
  production: false
  tls:
    enabled: false
    autoGenerated: false
  {% endif %}

  # ensure that the auth pod has enough resources to run. The default values are enough
  # in most cases, but for a larger environment, you might need to increase the limits.
  resources:
    limits:
      memory: 2Gi
      cpu: 1000m
    requests:
      memory: 1Gi
      cpu: 500m

  # The following configuration is run via the CLI when the Keycloak service is
  # initialized. It creates a number of users, roles and secrets that are required for
  # vantage6 to work properly.
  keycloakConfigCli:
    enabled: true
    configuration:
      # Keycloak realm configuration. For all options, see
      # https://www.keycloak.org/docs-api/latest/rest-api/index.html#RealmRepresentation
      realm:
        # Keycloak realm name
        realm: {{ keycloak.realm | default('vantage6') }}
        enabled: true

        # access token lifespan in seconds
        accessTokenLifespan: {{ keycloak.accessTokenLifespan | default(300) }}

        # sso session idle timeout in seconds. This is the time before the refresh token
        # expires. With default settings, this value controls the time before the
        # refresh token expires. Note that if setting this to >3600, you also need to
        # set ssoSessionMaxLifespan and/or clientSessionIdleTimeout and/or
        # clientSessionMaxLifespan to higher values to effectively lengthen the session.
        ssoSessionIdleTimeout: {{ keycloak.ssoSessionIdleTimeout | default(1800) }}

        # password policy configuration. If you prefer not to have a password policy,
        # you can set this to an empty string.
        {% if keycloak.production %}
        passwordPolicy: "length(8) and upperCase(1) and lowerCase(1) and digits(1) and specialChars(1)"
        {% else %}
        passwordPolicy: ""
        {% endif %}

        # do not allow users to edit their username - this would lead to problems with
        # syncing the user between keycloak and vantage6 server/store. This setting
        # should always be set to false.
        editUsernameAllowed: false

        {% if keycloak.production %}
        # required actions for users. By setting defaultAction to true for configuring
        # OTP, the user will be prompted to configure OTP (for two-factor
        # authentication) on first login.
        requiredActions:
          - alias: CONFIGURE_TOTP
            name: Configure OTP
            providerId: CONFIGURE_TOTP
            enabled: true
            defaultAction: true
            priority: 10
        {% else %}
        # If you want to require users to use two-factor authentication on first login,
        # enable the settings below.
        # requiredActions:
        #  - alias: CONFIGURE_TOTP
        #    name: Configure OTP
        #    providerId: CONFIGURE_TOTP
        #    enabled: true
        #    defaultAction: true
        #    priority: 10
        {% endif %}

        # users to be created in the realm. This initializes the realm with a default
        # admin user. It also initializes the service account for the backend admin
        # client to give it the necessary permissions to manage the realm.
        # TODO v5+ configure secrets where necessary
        users:
          # create the vantage6 admin user. The name of this user should also be present
          # in the vantage6 server and store configuration - it is the user that will be
          # assigned admin permissions on initial startup.
          - username: {{ keycloak.adminUser | default('admin') }}
            enabled: true
            {% if not keycloak.production %}
            email: admin@vantage6.org
            firstName: Admin
            lastName: Admin
            {% endif %}
            credentials:
              - type: password
                {% if keycloak.production %}
                value: {{ keycloak.adminPassword | default('Admin123!') }}
                {% else %}
                value: {{ keycloak.adminPassword | default('admin') }}
                {% endif %}
            requiredActions:
              {% if keycloak.production %}
              # this requires all users to update their password on first login and
              # configure two-factor authentication
              - CONFIGURE_TOTP
              - UPDATE_PASSWORD
              {% elif keycloak.no_password_update_required%}
              # enable configure OTP only if you want to use two-factor authentication
              # - CONFIGURE_TOTP
              # enable password update if you want every user to have to change their
              # password on first login
              # - UPDATE_PASSWORD
              {% else %}
              # enable configure OTP only if you want to use two-factor authentication
              # - CONFIGURE_TOTP
              # this requires all users to update their password on first login
              - UPDATE_PASSWORD
              {% endif %}
          # create a service account user for the backend admin client. The
          # serviceAccountClientId should match the value set in the client section
          # below. The vantage6 server and store will use this user to create new
          # accounts for users and nodes in keycloak - that is why it gets assigned some
          # realm-management permissions.
          - username: service-account-backend-admin-client
            enabled: true
            serviceAccountClientId: backend-admin-client
            clientRoles:
              realm-management:
                - view-users
                - manage-users
                - view-clients
                - manage-clients
                - create-client

        # clients to be created in the realm. This initializes the realm with a default
        # public client and a backend admin client. The public client is used by users
        # to authenticate in the browser. Either the UI or the Python client will
        # redirect to this client.
        clients:
          - clientId: public_client
            publicClient: true
            # redirect URIs are the URIs that keycloak is allowed to redirect to after
            # authentication. This should be set to the UI URL, and to the Keyloak
            # service on port 7681. The latter is needed for authentication from outside
            # the browser - if e.g. the Python client authenticates, it will open a
            # browser window to authenticate that redirects to the Keycloak service on
            # port 7681.
            {% if keycloak.redirectUris %}
            redirectUris:
              {% for uri in keycloak.redirectUris %}
              - "{{ uri }}/*"
              {% endfor %}
            {% else %}
            redirectUris:
              # allow logging in via a local UI
              - "http://localhost:7600/*"
              # allow logging in via the Python client (which spins up a local server
              # on port 7681)
              - "http://localhost:7681/*"
            {% endif %}
            # By setting webOrigins to "+", we allow the same origins as redirectUris.
            webOrigins:
              - "+"
            # The public client is only for users, not for nodes. Therefore, map a
            # constant claim to indicate the that the client is a user.
            protocolMappers:
              - name: vantage6_client_type
                protocol: openid-connect
                protocolMapper: oidc-hardcoded-claim-mapper
                consentRequired: false
                config:
                  claim.name: vantage6_client_type
                  claim.value: user
                  access.token.claim: true
          # create a client that will allow the backend to manage users and clients in
          # keycloak.
          - clientId: backend-admin-client
            publicClient: false
            # TODO v5+ configure secrets where necessary
            secret: myadminclientsecret
            serviceAccountsEnabled: true
            standardFlowEnabled: false
