# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `keycloak:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream Bitnami keycloak
  # chart exposes per-component `keycloak.image.registry`,
  # `keycloak.postgresql.image.registry`, etc. for fine-grained override.
  # Per-Sovereign overlays wire those alongside this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  upstream: { chart: keycloak, version: "25.2.0", repo: "https://charts.bitnami.com/bitnami" }

# ─── Per-Sovereign identity configuration (issue #604, Phase-8b) ──────────
#
# sovereignFQDN: the Sovereign's base FQDN (e.g. "otech.omani.works").
# Used by the configmap-sovereign-realm.yaml template to render catalyst-ui
# redirect/origin URIs as https://console.<sovereignFQDN>/*.
# REQUIRED when sovereignRealm.enabled — no default per Inviolable Principle #4.
# Per-Sovereign bootstrap-kit HelmRelease overlay supplies this.
sovereignFQDN: ""

# sovereignRealm.enabled: when true, the configmap-sovereign-realm.yaml
# template emits the realm import ConfigMap and keycloakConfigCli references it
# via existingConfigmap. Set false only if running Keycloak without the Sovereign
# realm (e.g. Catalyst-Zero admin-only install — tracked as future work).
sovereignRealm:
  enabled: true

# catalystApiServerClientSecret: the client secret for the catalyst-api-server
# confidential client in the sovereign realm.
#
# Resolution order in templates/configmap-sovereign-realm.yaml:
#   1. operator-supplied .Values.catalystApiServerClientSecret (this key)
#   2. helm `lookup` of existing catalyst-kc-sa-credentials Secret
#      in .Release.Namespace (idempotent across upgrades)
#   3. fresh randAlphaNum 32 (zero-touch on first install)
#
# Default empty = self-bootstrap via #3 on a fresh Sovereign. The chart
# materialises both the realm import (with this secret baked into the
# catalyst-api-server client JSON) AND the catalyst-kc-sa-credentials
# Secret in the keycloak namespace, mirrored to catalyst-system by
# emberstack/reflector. catalyst-api consumes the mirror as env vars
# CATALYST_KC_ADDR / CATALYST_KC_REALM / CATALYST_KC_SA_CLIENT_ID /
# CATALYST_KC_SA_CLIENT_SECRET (see products/catalyst/chart/templates/
# api-deployment.yaml).
#
# Set this key only when replicating a known secret from an existing
# sealed-secret / external secret store (rare; the lookup-or-generate
# pattern handles re-provisions automatically). NEVER commit a real
# value here.
catalystApiServerClientSecret: ""

# ─── SMTP for outbound realm email (welcome / password-reset) (issue #604) ─
#
# Pre-handover default: contabo Stalwart relay (cluster-internal FQDN, reachable
# during Phase-8a/8b when the Sovereign is on Hetzner with VPN to contabo).
# Phase-8c-note: migrate to Sovereign-local SMTP relay to eliminate contabo dep.
# password is intentionally empty here — NOT committed in plaintext.
# Per-Sovereign overlay injects it via a SealedSecret-backed HelmRelease valuesFrom.
smtp:
  host: "stalwart-smtp-relay.openova-system.svc.cluster.local"
  port: "587"
  from: "noreply@openova.io"
  user: ""
  password: ""
  ssl: "false"
  starttls: "true"
  auth: "true"

# ─── Upstream chart values (subchart key: keycloak) ───────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
keycloak:
  auth:
    adminUser: admin
  production: true
  # Chart 25.x renamed `proxy: edge` to `proxyHeaders: "xforwarded"`. Catalyst
  # fronts Keycloak with Cilium Gateway (which sets `X-Forwarded-*`), and we
  # require `proxyHeaders` to be set so chart-level production-mode validation
  # passes without forcing in-pod TLS.
  proxyHeaders: "xforwarded"
  # ─── Bitnami image-registry consolidation (issue #191) ──────────────────
  # Bitnami consolidated their tag scheme around 2025-09 (see
  # https://github.com/bitnami/charts/issues/30852). The original
  # `bitnami/keycloak:<x>-debian-12-rN` tags now 404 in the registry; the
  # preserved historic tags moved to `bitnamilegacy/*` (read-only archive,
  # explicitly published as "no longer updated, may be removed in the
  # future"). Override repository for every Bitnami image referenced by
  # this chart (keycloak app, keycloak-config-cli sidecar, postgresql,
  # postgres-exporter, os-shell init) so `helm install` resolves real
  # manifests. Verified existence with registry HEAD calls before pinning.
  # Tag stays the chart 25.2.0 default (`26.3.3-debian-12-r0`) — re-pin
  # when the chart bumps and we re-verify the new tag.
  image:
    registry: docker.io
    repository: bitnamilegacy/keycloak
    tag: 26.3.3-debian-12-r0
  postgresql:
    enabled: true
    auth:
      username: keycloak
      database: keycloak
    image:
      registry: docker.io
      repository: bitnamilegacy/postgresql
      tag: 17.6.0-debian-12-r0
    metrics:
      image:
        registry: docker.io
        repository: bitnamilegacy/postgres-exporter
        tag: 0.17.1-debian-12-r15
    volumePermissions:
      image:
        registry: docker.io
        repository: bitnamilegacy/os-shell
        tag: 12-debian-12-r50
  ingress:
    enabled: false  # Catalyst uses Cilium Gateway API (see `gateway:` block below), not the upstream chart ingress
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits: { memory: 2Gi }
  # ─── keycloak-config-cli: Sovereign realm + kubectl OIDC client (issue #326) ──
  #
  # Bootstrap a `sovereign` realm with a public OIDC client `kubectl` so
  # customer admins on the Sovereign can authenticate `kubectl` against
  # the per-Sovereign K8s api-server (k3s --kube-apiserver-arg=oidc-* in
  # infra/hetzner/cloudinit-control-plane.tftpl). The k3s api-server
  # validates id-tokens issued by `https://auth.<sovereign-fqdn>/realms/
  # sovereign`, so the realm name is invariant per Sovereign — only the
  # issuer hostname differs (Keycloak resolves the issuer claim from the
  # request hostname automatically; no per-Sovereign realm rename needed).
  #
  # Why this is the canonical seam:
  #   The bitnami/keycloak chart ships a post-deploy Job
  #   (templates/keycloak-config-cli-job.yaml) that consumes
  #   `keycloakConfigCli.configuration` as a ConfigMap and runs upstream
  #   `keycloak-config-cli` against the Keycloak Admin API to import the
  #   realm. This is the upstream-supported, idempotent realm-import
  #   mechanism — re-running the Helm install on the same release is a
  #   no-op once the realm exists. Per anti-duplication rule + ADR-0001
  #   §11.3 we MUST NOT replace this with a bespoke kubectl-exec script
  #   or a custom Admin-API call from catalyst-api.
  #
  # `kubectl` client shape:
  #   - publicClient: true (no client secret — kubectl runs locally)
  #   - standardFlowEnabled: true (browser auth-code → localhost:8000)
  #   - directAccessGrantsEnabled: true (allows resource-owner password
  #     grant for non-interactive CI/CD use; customer admins can disable)
  #   - redirectUris: ["http://localhost:8000/*", "urn:ietf:wg:oauth:2.0:oob"]
  #     (kubectl-oidc-login default callback + out-of-band fallback)
  #   - protocolMappers: include `groups` claim in id-token so api-server
  #     can apply group-based RoleBindings (oidc:<group> prefix per
  #     k3s --oidc-groups-prefix flag)
  keycloakConfigCli:
    enabled: true
    # Run the realm-import Job as a Helm post-install hook so the realm
    # is provisioned exactly once per fresh release. Re-run on upgrade
    # is idempotent (config-cli reconciles the realm to spec).
    image:
      registry: docker.io
      repository: bitnamilegacy/keycloak-config-cli
      tag: 6.4.0-debian-12-r11
    # ─── Phase-8b realm ConfigMap (issue #604) ───────────────────────────────
    # The realm import JSON is now owned by the parent bp-keycloak chart's
    # templates/configmap-sovereign-realm.yaml template. That template has
    # access to .Values.sovereignFQDN and .Values.smtp.* for per-Sovereign
    # interpolation — not possible when the JSON lives inside the `keycloak:`
    # subchart values key (subchart scope only sees keycloak.* values).
    #
    # The upstream bitnami/keycloak chart honours `keycloakConfigCli.existingConfigmap`:
    # when set it skips creating its own ConfigMap and uses the named one instead.
    # Name convention: "<releaseName>-sovereign-realm-config".
    # With the bootstrap-kit default releaseName=keycloak → "keycloak-sovereign-realm-config".
    # Operators using a non-default releaseName must override this key to match.
    existingConfigmap: keycloak-sovereign-realm-config
  # Metrics + ServiceMonitor + PrometheusRule — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). The upstream
  # bitnami/keycloak chart's `metrics.serviceMonitor.enabled` and
  # `metrics.prometheusRule.enabled` render monitoring.coreos.com/v1
  # resources which the apiserver rejects on a fresh Sovereign before
  # bp-kube-prometheus-stack ships the CRDs. Upstream already defaults
  # all three to false — set explicitly so a future upstream bump cannot
  # regress this. Operator opts in via per-cluster overlay (issue #182).
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
    prometheusRule:
      enabled: false

# ─── Catalyst HTTPRoute (Cilium Gateway API, issue #387) ──────────────────
# Replaces the upstream chart's networking.k8s.io/v1.Ingress on Sovereigns.
# Per-Sovereign overlay supplies `gateway.host` (e.g. auth.<sovereign-fqdn>).
# parentRef defaults to cilium-gateway/kube-system, the per-Sovereign
# Gateway shipped by clusters/_template/bootstrap-kit/01-cilium.yaml.
gateway:
  enabled: true
  # host: auth.<sovereign-fqdn> — REQUIRED, no default per Inviolable Principle #4
  host: ""
  path: "/"
  # Backend Service — defaults to <release>-keycloak (bitnami subchart fullname)
  backendService: ""
  backendPort: 80
  parentRef:
    name: cilium-gateway
    namespace: kube-system
    sectionName: https
