# for more options on the deployment of this chart, see:
# https://artifacthub.io/packages/helm/bitnami/keycloak
keycloak:

  # Specify the version of the Keycloak Operator to use.
  {% if keycloak.operatorVersion is defined %}
  operatorVersion: {{ keycloak.operatorVersion }}
  {% else %}
  # operatorVersion: "26.0.0"
  {% endif %}

  # Specify the number of Keycloak instances to deploy.
  instances: {{ keycloak.instances | default(1) }}

  # for development, use a local PostgreSQL instance.
  {% if keycloak.production %}
  # for production, TLS should be enabled for internal Keycloak communication
  production: true
  tls:
    enabled: true
    autoGenerated: true

  # Specify the hostname of the Keycloak instance. Only required for production
  # environments.
  hostname: {{ keycloak.hostname | default('') }}
  {% else %}
  # if you want to switch to production, you should set the following settings to true.
  production: false
  tls:
    enabled: false
    autoGenerated: false

  dev:
    forward_ports: true
    {% if keycloak.dev is defined %}
    local_auth_port_to_expose: {{ keycloak.dev.local_auth_port_to_expose }}
    {% else %}
    local_auth_port_to_expose: 30764
    {% endif %}
  {% endif %}

  # Set the username and password for the Keycloak admin. This user is created when
  # Keycloak is initialized and can be used to login to the Keycloak admin UI and
  # manage Keycloak settings.
  auth:
    {% if keycloak.adminUserSecret is defined %}
    # The following secret must contain the 'username' and 'password' keys.
    adminUserSecret: {{ keycloak.adminUserSecret }}
    # for development environments, you can set the username and password directly.
    # adminUser: admin
    # adminPassword: admin
    {% else %}
    adminUser: {{ keycloak.adminUser | default('admin') }}
    adminPassword: {{ keycloak.adminPassword | default('admin') }}
    # for production, we recommend storing the admin password in a secret (which MUST
    # contain the 'username' and 'password' keys).
    # adminPassword: {{ keycloak.adminPassword | default('admin') }}
    {% endif %}

  # ensure that the auth pod has enough resources to run. The default values are enough
  # in most cases, but for a larger environment, you might need to increase the limits.
  resources:
    limits:
      memory: 2Gi
      cpu: 1000m
    requests:
      memory: 1Gi
      cpu: 500m

  # The following configuration initializes the Keycloak realm upon startup. It creates
  # a number of users, roles and secrets that are required for vantage6.
  realmImport:
    enabled: true
    # Keycloak realm name
    realm: {{ keycloak.realm | default('vantage6') }}

    # access token lifespan in seconds
    accessTokenLifespan: {{ keycloak.accessTokenLifespan | default(300) }}

    # sso session idle timeout in seconds. This is the time before the refresh token
    # expires. With default settings, this value controls the time before the
    # refresh token expires. Note that if setting this to >3600, you also need to
    # set ssoSessionMaxLifespan and/or clientSessionIdleTimeout and/or
    # clientSessionMaxLifespan to higher values to effectively lengthen the session.
    ssoSessionIdleTimeout: {{ keycloak.ssoSessionIdleTimeout | default(1800) }}

    # password policy configuration. If you prefer not to have a password policy,
    # you can set this to an empty string.
    {% if keycloak.production %}
    passwordPolicy: "length(8) and upperCase(1) and lowerCase(1) and digits(1) and specialChars(1)"
    {% else %}
    passwordPolicy: ""
    {% endif %}

    # do not allow users to edit their username - this would lead to problems with
    # syncing the user between keycloak and vantage6 HQ+store. This setting
    # should always be set to false.
    editUsernameAllowed: false

    {% if keycloak.production %}
    # required actions for users. By setting defaultAction to true for configuring
    # OTP, the user will be prompted to configure OTP (for two-factor
    # authentication) on first login.
    requiredActions:
      - alias: CONFIGURE_TOTP
        name: Configure OTP
        providerId: CONFIGURE_TOTP
        enabled: true
        defaultAction: true
        priority: 10
    {% else %}
    # If you want to require users to use two-factor authentication on first login,
    # enable the settings below.
    # requiredActions:
    #  - alias: CONFIGURE_TOTP
    #    name: Configure OTP
    #    providerId: CONFIGURE_TOTP
    #    enabled: true
    #    defaultAction: true
    #    priority: 10
    {% endif %}

    # users to be created in the realm. This initializes the realm with a default
    # admin user. It also initializes the service account for the backend admin
    # client to give it the necessary permissions to manage the realm.
    # TODO v5+ configure secrets where necessary
    users:
      # create the vantage6 admin user. The name of this user should also be present
      # in vantage6 HQ and store configuration - it is the user that will be
      # assigned admin permissions on initial startup.
      - username: {{ keycloak.adminUser | default('admin') }}
        enabled: true
        {% if not keycloak.production %}
        email: admin@vantage6.org
        firstName: Admin
        lastName: Admin
        {% endif %}
        credentials:
          - type: password
            {% if keycloak.production %}
            value: {{ keycloak.adminPassword | default('Admin123!') }}
            {% else %}
            value: {{ keycloak.adminPassword | default('admin') }}
            {% endif %}
        requiredActions:
          {% if keycloak.production %}
          # this requires all users to update their password on first login and
          # configure two-factor authentication
          - CONFIGURE_TOTP
          - UPDATE_PASSWORD
          {% elif keycloak.no_password_update_required%}
          # enable configure OTP only if you want to use two-factor authentication
          # - CONFIGURE_TOTP
          # enable password update if you want every user to have to change their
          # password on first login
          # - UPDATE_PASSWORD
          {% else %}
          # enable configure OTP only if you want to use two-factor authentication
          # - CONFIGURE_TOTP
          # this requires all users to update their password on first login
          - UPDATE_PASSWORD
          {% endif %}
      # create a service account user for the backend admin client. The
      # serviceAccountClientId should match the value set in the client section
      # below. The vantage6 HQ and store will use this user to create new
      # accounts for users and nodes in keycloak - that is why it gets assigned some
      # realm-management permissions.
      - username: service-account-backend-admin-client
        enabled: true
        serviceAccountClientId: backend-admin-client
        clientRoles:
          realm-management:
            - view-users
            - manage-users
            - view-clients
            - manage-clients
            - create-client

    # clients to be created in the realm. This initializes the realm with a default
    # public client and a backend admin client. The public client is used by users
    # to authenticate in the browser. Either the UI or the Python client will
    # redirect to this client.
    clients:
      - clientId: public_client
        publicClient: true
        # redirect URIs are the URIs that keycloak is allowed to redirect to after
        # authentication. This should be set to the UI URL, and to the Keyloak
        # service on port 7681. The latter is needed for authentication from outside
        # the browser - if e.g. the Python client authenticates, it will open a
        # browser window to authenticate that redirects to the Keycloak service on
        # port 7681.
        {% if keycloak.redirectUris %}
        redirectUris:
          {% for uri in keycloak.redirectUris %}
          - "{{ uri }}/*"
          {% endfor %}
        {% else %}
        redirectUris:
          # allow logging in via a local UI
          - "http://localhost:7600/*"
          # allow logging in via the Python client (which spins up a local server
          # on port 7681)
          - "http://localhost:7681/*"
        {% endif %}
        # By setting webOrigins to "+", we allow the same origins as redirectUris.
        webOrigins:
          - "+"
        # The public client is only for users, not for nodes. Therefore, map a
        # constant claim to indicate the that the client is a user.
        protocolMappers:
          - name: vantage6_client_type
            protocol: openid-connect
            protocolMapper: oidc-hardcoded-claim-mapper
            consentRequired: false
            config:
              claim.name: vantage6_client_type
              claim.value: user
              access.token.claim: true
      # create a client that will allow the backend to manage users and clients in
      # keycloak.
      - clientId: backend-admin-client
        publicClient: false
        {% if keycloak.adminClientSecret is defined %}
        secret: {{ keycloak.adminClientSecret }}
        {% else %}
        secret: myadminclientsecret
        {% endif %}
        serviceAccountsEnabled: true
        standardFlowEnabled: false


database:
  {% if keycloak.production %}
  external: true
  hostname: {{ database.host | default('') }}
  {% else %}
  external: false
  image:
    repository: postgres
    tag: "13"
  username: keycloak
  password: keycloak
  name: keycloak
  volumePath: {{ database.volumePath | default('/mnt/data_auth') }}
  k8sNodeName: {{ database.k8sNodeName | default('docker-desktop') }}
  storageClass: {{ database.storageClass | default('local-storage') }}
  {% endif %}