{% from "_yaml_macros.j2" import yaml_sq %}
{% set hg = hubGateway | default({}) %}
{% set hg_hosts = hg.hosts | default({}) %}
{% set hg_tls = hg.tls | default({}) %}
{% set hg_tls_existing = hg_tls.existingSecrets | default({}) %}
{% set hg_cm = hg.certManager | default({}) %}
hubGateway:
  # Enable or disable the built‑in Gateway resources for Auth, HQ, Portal and Store.
  enabled: {{ hg.enabled | default(false) }}

  # Public hostnames per component (subdomain routing).
  # Example: auth.example.com, hq.example.com, portal.example.com, store.example.com
  hosts:
    auth: {{ hg_hosts.auth | default('') }}
    hq: {{ hg_hosts.hq | default('') }}
    portal: {{ hg_hosts.portal | default('') }}
    store: {{ hg_hosts.store | default('') }}

  # TLS configuration for all Gateway listeners.
  tls:
    # Use cert-manager by default, or reference an existing secret.
    # We recommend letting cert-manager handle the certificates for you.
    # Valid values: "cert-manager" or "existingSecret".
    mode: {{ hg_tls.mode | default('cert-manager') }}

    # If you specified existingSecrets above, you must specify the secrets here.
    existingSecrets:
      auth: {{ hg_tls_existing.auth | default('') }}
      hq: {{ hg_tls_existing.hq | default('') }}
      portal: {{ hg_tls_existing.portal | default('') }}
      store: {{ hg_tls_existing.store | default('') }}

  # cert-manager related settings used when tls.mode == "cert-manager".
  certManager:
    # Whether the hub chart should create Certificate resources and expect
    # cert-manager CRDs to be installed.
    enabled: {{ hg_cm.enabled | default(true) }}

    # Name of the ClusterIssuer that should be used by the Certificates.
    clusterIssuer: {{ hg_cm.clusterIssuer | default('letsencrypt-prod') }}

global:
  # Shared public and internal URLs for all components. These are used as defaults
  # in the subcharts (HQ, Auth, Store).
  urls:
    external:
      # Public URLs as seen by end users (typically via ingress, gateway or load balancer).
      auth: {{ urls.external.auth }}
      store: {{ urls.external.store }}
      ui: {{ urls.external.ui }}
      hq: {{ urls.external.hq }}
    internal:
      # Internal URLs used for service-to-service communication inside the cluster.
      auth: {{ urls.internal.auth }}
      store: {{ urls.internal.store }}
      ui: {{ urls.internal.ui }}
      hq: {{ urls.internal.hq }}

  # Shared Keycloak configuration used by the hub and subcharts.
  keycloak:
    # Base URL of the Keycloak instance (usually the internal service URL).
    url: {{ keycloak.url }}

    # Name of the Keycloak realm used by vantage6.
    realm: {{ keycloak.realm | default('vantage6') }}

    # Name of the client that is allowed to manage users/clients in the realm.
    adminClient: {{ keycloak.adminClient | default('backend-admin-client') }}

    # Name of the public client used by users (e.g. the portal).
    publicClient: {{ keycloak.publicClient | default('public_client') }}

    # Credentials for the Vantage6 admin user. For production deployments you
    # should override these with secure values, preferably from a secret.
    adminUsername: {{ keycloak.adminUsername | default('admin') }}
    adminPassword: {{ yaml_sq(keycloak.adminPassword | default('admin')) }}

    # Secret for the admin client that is used by backend services.
    adminClientSecret: {{ yaml_sq(keycloak.adminClientSecret | default('myadminclientsecret')) }}
