{% from "_yaml_macros.j2" import yaml_sq, yaml_optional_sq_field %}

keycloak:
  # Whether the Keycloak is deployed standalone or as part of a vantage6 hub.
  standalone: {{ keycloak.standalone | default(false) }}

  # Specify the version of the Keycloak Operator to use.
  {% if keycloak.operatorVersion is defined %}
  operatorVersion: {{ keycloak.operatorVersion }}
  {% else %}
  # operatorVersion: "26.0.0"
  {% endif %}

  # Specify the number of Keycloak instances to deploy.
  instances: {{ keycloak.instances | default(1) }}

  # for development, use a local PostgreSQL instance.
  {% if keycloak.production %}
  # Whether to use production settings. Note that this setting impacts many settings.
  # In case it is false, this causes users and secrets to be set to simple, non-secure
  # (initial) values. Always set this to true in production environments.
  production: true

  # If Keycloak is exposed via a Gateway (or other external load balancer) that
  # terminates TLS, Keycloak should run HTTP internally and trust proxy headers.
  behindGateway:
    enabled: {{ keycloak.behindGateway.enabled if keycloak.behindGateway is defined else false }}
    proxyHeaders: {{ keycloak.behindGateway.proxyHeaders if keycloak.behindGateway is defined else 'xforwarded' }}
    httpPort: {{ keycloak.behindGateway.httpPort if keycloak.behindGateway is defined else 7680 }}

  # For production, Keycloak TLS can be enabled for internal communication.
  # If `behindGateway.enabled` is true, TLS should be disabled here.
  tls:
    {% if keycloak.behindGateway is defined and keycloak.behindGateway.enabled %}
    enabled: false
    autoGenerated: false
    {% else %}
    enabled: true
    autoGenerated: true
    {% endif %}

  # Specify the hostname of the Keycloak instance. Only required for production
  # environments.
  hostname: {{ keycloak.hostname | default('') }}
  {% else %}
  # Whether to use production settings. Note that this setting impacts many settings.
  # In case it is false, this causes users and secrets to be set to simple, non-secure
  # (initial) values. Always set this to true in production environments.
  production: false

  # TLS settings - should be enabled for production environments.
  tls:
    enabled: false
    autoGenerated: false

  dev:
    forward_ports: true
    {% if keycloak.dev is defined %}
    local_auth_port_to_expose: {{ keycloak.dev.local_auth_port_to_expose }}
    {% else %}
    local_auth_port_to_expose: 30764
    {% endif %}
  {% endif %}

  # Set the username and password for the Keycloak admin. This user is created when
  # Keycloak is initialized and can be used to login to the Keycloak admin UI and
  # manage Keycloak settings.
  auth:
    {% if keycloak.adminUserSecret is defined %}
    # The following secret must contain the 'username' and 'password' keys.
    adminUserSecret: {{ keycloak.adminUserSecret }}
    # for development environments, you can set the username and password directly.
    # adminUser: admin
    # adminPassword: admin
    {% else %}
    adminUser: {{ keycloak.adminUser | default('admin') }}
    adminPassword: {{ yaml_sq(keycloak.adminPassword | default('admin')) }}
    # for production, we recommend storing the admin password in a secret (which MUST
    # contain the 'username' and 'password' keys).
    # adminPassword: {{ keycloak.adminPassword | default('admin') }}
    {% endif %}

  # ensure that the auth pod has enough resources to run. The default values are enough
  # in most cases, but for a larger environment, you might need to increase the limits.
  resources:
    limits:
      memory: 2Gi
      cpu: 1000m
    requests:
      memory: 1Gi
      cpu: 500m

  # The following configuration initializes the Keycloak realm upon startup. It creates
  # a number of users, roles and secrets that are required for vantage6.
  realmImport:
    enabled: true
    {% if keycloak.standalone is defined and keycloak.standalone %}
    realm: {{ keycloak.realm | default('vantage6') }}
    {% endif %}

    # access token lifespan in seconds
    accessTokenLifespan: {{ keycloak.accessTokenLifespan | default(300) }}

    # sso session idle timeout in seconds. This is the time before the refresh token
    # expires. With default settings, this value controls the time before the
    # refresh token expires. Note that if setting this to >3600, you also need to
    # set ssoSessionMaxLifespan and/or clientSessionIdleTimeout and/or
    # clientSessionMaxLifespan to higher values to effectively lengthen the session.
    ssoSessionIdleTimeout: {{ keycloak.ssoSessionIdleTimeout | default(1800) }}

    # password policy configuration. If you prefer not to have a password policy,
    # you can set this to an empty string.
    {% if keycloak.production %}
    passwordPolicy: "length(8) and upperCase(1) and lowerCase(1) and digits(1) and specialChars(1)"
    {% else %}
    passwordPolicy: ""
    {% endif %}

    # allow users to reset their password
    resetPasswordAllowed: {{ keycloak.resetPasswordAllowed | default(false) }}

    # brute force protection settings
    # - bruteForceProtected: enable brute force protection
    # - permanentLockout: whether to lock out a user permanently after a certain number
    #   of failed login attempts.
    # - failureFactor: the number of failed login attempts before a user is locked out.
    bruteForceProtected: {{ keycloak.bruteForceProtected | default(false) }}
    permanentLockout: {{ keycloak.permanentLockout | default(false) }}
    failureFactor: {{ keycloak.failureFactor | default(5) }}

    # Define the vantage6 admin user.
    {% if keycloak.standalone is defined and keycloak.standalone %}
    admin:
      {% if keycloak.adminUser is defined %}
      username: {{ keycloak.adminUser | default('admin') }}
      {% endif %}
      {% if keycloak.production %}
      password: {{ yaml_sq(keycloak.adminPassword | default('Admin123!')) }}
      {% else %}
      password: {{ yaml_sq(keycloak.adminPassword | default('admin')) }}
      {% endif %}
    {% endif %}

    # whether to verify email on first login. This should only be enabled if an SMTP
    # server is configured to send emails.
    verifyEmail: {{ keycloak.verifyEmail | default(false) }}

    # whether to require users to update their password on first login.
    passwordUpdateRequired: {{ keycloak.passwordUpdateRequired | default(true) }}

    # public client configuration. The public client is used by users to authenticate
    # in the browser.
    publicClient:
      {% if keycloak.publicClient is defined %}
      name: {{ keycloak.publicClient.name | default('public_client') }}
      {% endif %}
      # redirect URIs are the URIs that keycloak is allowed to redirect to after
      # authentication. This should normally be set to the UI URL. If you have
      # other applications that can use the vantage6 Keycloak instance, those should be
      # added as well.
      redirectUris:
        {% if keycloak.publicClient.redirectUris %}
        {% for uri in keycloak.publicClient.redirectUris %}
        - "{{ uri }}/*"
        {% endfor %}
        {% else %}
        # allow logging in via a local UI
        - "http://localhost:7600/*"
        {% endif %}

    {% if keycloak.standalone is defined and keycloak.standalone %}
    backend_client_secret: {{ yaml_sq(keycloak.adminClientSecret | default('myadminclientsecret')) }}
    {% endif %}

    # SMTP server configuration for email sending
    {% if keycloak.smtpServer is defined %}
    smtpServer:
{{ yaml_optional_sq_field('host', keycloak.smtpServer.host, 6) -}}
{{ yaml_optional_sq_field('port', keycloak.smtpServer.port, 6) -}}
{{ yaml_optional_sq_field('from', keycloak.smtpServer.from, 6) -}}
{{ yaml_optional_sq_field('fromDisplayName', keycloak.smtpServer.fromDisplayName, 6) -}}
{{ yaml_optional_sq_field('replyTo', keycloak.smtpServer.replyTo, 6) -}}
{{ yaml_optional_sq_field('replyToDisplayName', keycloak.smtpServer.replyToDisplayName, 6) -}}
{{ yaml_optional_sq_field('ssl', keycloak.smtpServer.ssl, 6) -}}
{{ yaml_optional_sq_field('starttls', keycloak.smtpServer.starttls, 6) -}}
{{ yaml_optional_sq_field('auth', keycloak.smtpServer.auth, 6) -}}
{{ yaml_optional_sq_field('authType', keycloak.smtpServer.authType, 6) -}}
{{ yaml_optional_sq_field('user', keycloak.smtpServer.user, 6) -}}
{{ yaml_optional_sq_field('password', keycloak.smtpServer.password, 6) -}}
    {% else %}
    # smtpServer:
    #  host: your-smtp-server-hostname.org
    #  port: 587                # usually 587 for STARTTLS, 465 for SSL
    #  from: your-email-address@your-domain.com
    #  ssl: false                # true for SSL, false for STARTTLS
    #  starttls: true            # true for STARTTLS, false for SSL
    #  auth: true                # Usually true, unless running tests on localhost
    #  authType: basic           # basic for username and password, bearer for bearer token (not supported yet)
    #  user: your-username       # your username (often the same as the email address)
    #  password: your-password   # your password
    #  replyTo: reply-to-email-address@your-domain.com  # optional, may be the same as the from address
    #  replyToDisplayName: display-name-for-reply-to  # optional
    {% endif %}


database:
  external: {{ database.external | default(false) }}
  host: {{ database.host | default('') }}
  port: {{ database.port | default(5432) }}
  username: {{ database.username | default('keycloak') }}
  password: {{ yaml_sq(database.password | default('keycloak')) }}
  name: {{ database.name | default('keycloak') }}
  {% if not database.external %}
  image:
    repository: postgres
    tag: "13"
  volumePath: {{ database.volumePath | default('/mnt/data_auth') }}
    {% if database.k8sNodeName is defined %}
  k8sNodeName: {{ database.k8sNodeName }}
    {% endif %}
  storageClass: {{ database.storageClass | default('local-storage') }}
  {% endif %}