# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `keycloak:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream Bitnami keycloak
  # chart exposes per-component `keycloak.image.registry`,
  # `keycloak.postgresql.image.registry`, etc. for fine-grained override.
  # Per-Sovereign overlays wire those alongside this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  upstream: { chart: keycloak, version: "25.2.0", repo: "https://charts.bitnami.com/bitnami" }

# ─── Upstream chart values (subchart key: keycloak) ───────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
keycloak:
  auth:
    adminUser: admin
  production: true
  # Chart 25.x renamed `proxy: edge` to `proxyHeaders: "xforwarded"`. Catalyst
  # fronts Keycloak with Cilium Gateway (which sets `X-Forwarded-*`), and we
  # require `proxyHeaders` to be set so chart-level production-mode validation
  # passes without forcing in-pod TLS.
  proxyHeaders: "xforwarded"
  # ─── Bitnami image-registry consolidation (issue #191) ──────────────────
  # Bitnami consolidated their tag scheme around 2025-09 (see
  # https://github.com/bitnami/charts/issues/30852). The original
  # `bitnami/keycloak:<x>-debian-12-rN` tags now 404 in the registry; the
  # preserved historic tags moved to `bitnamilegacy/*` (read-only archive,
  # explicitly published as "no longer updated, may be removed in the
  # future"). Override repository for every Bitnami image referenced by
  # this chart (keycloak app, keycloak-config-cli sidecar, postgresql,
  # postgres-exporter, os-shell init) so `helm install` resolves real
  # manifests. Verified existence with registry HEAD calls before pinning.
  # Tag stays the chart 25.2.0 default (`26.3.3-debian-12-r0`) — re-pin
  # when the chart bumps and we re-verify the new tag.
  image:
    registry: docker.io
    repository: bitnamilegacy/keycloak
    tag: 26.3.3-debian-12-r0
  postgresql:
    enabled: true
    auth:
      username: keycloak
      database: keycloak
    image:
      registry: docker.io
      repository: bitnamilegacy/postgresql
      tag: 17.6.0-debian-12-r0
    metrics:
      image:
        registry: docker.io
        repository: bitnamilegacy/postgres-exporter
        tag: 0.17.1-debian-12-r15
    volumePermissions:
      image:
        registry: docker.io
        repository: bitnamilegacy/os-shell
        tag: 12-debian-12-r50
  ingress:
    enabled: false  # Catalyst uses Cilium Gateway API (see `gateway:` block below), not the upstream chart ingress
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits: { memory: 2Gi }
  # ─── keycloak-config-cli: Sovereign realm + kubectl OIDC client (issue #326) ──
  #
  # Bootstrap a `sovereign` realm with a public OIDC client `kubectl` so
  # customer admins on the Sovereign can authenticate `kubectl` against
  # the per-Sovereign K8s api-server (k3s --kube-apiserver-arg=oidc-* in
  # infra/hetzner/cloudinit-control-plane.tftpl). The k3s api-server
  # validates id-tokens issued by `https://auth.<sovereign-fqdn>/realms/
  # sovereign`, so the realm name is invariant per Sovereign — only the
  # issuer hostname differs (Keycloak resolves the issuer claim from the
  # request hostname automatically; no per-Sovereign realm rename needed).
  #
  # Why this is the canonical seam:
  #   The bitnami/keycloak chart ships a post-deploy Job
  #   (templates/keycloak-config-cli-job.yaml) that consumes
  #   `keycloakConfigCli.configuration` as a ConfigMap and runs upstream
  #   `keycloak-config-cli` against the Keycloak Admin API to import the
  #   realm. This is the upstream-supported, idempotent realm-import
  #   mechanism — re-running the Helm install on the same release is a
  #   no-op once the realm exists. Per anti-duplication rule + ADR-0001
  #   §11.3 we MUST NOT replace this with a bespoke kubectl-exec script
  #   or a custom Admin-API call from catalyst-api.
  #
  # `kubectl` client shape:
  #   - publicClient: true (no client secret — kubectl runs locally)
  #   - standardFlowEnabled: true (browser auth-code → localhost:8000)
  #   - directAccessGrantsEnabled: true (allows resource-owner password
  #     grant for non-interactive CI/CD use; customer admins can disable)
  #   - redirectUris: ["http://localhost:8000/*", "urn:ietf:wg:oauth:2.0:oob"]
  #     (kubectl-oidc-login default callback + out-of-band fallback)
  #   - protocolMappers: include `groups` claim in id-token so api-server
  #     can apply group-based RoleBindings (oidc:<group> prefix per
  #     k3s --oidc-groups-prefix flag)
  keycloakConfigCli:
    enabled: true
    # Run the realm-import Job as a Helm post-install hook so the realm
    # is provisioned exactly once per fresh release. Re-run on upgrade
    # is idempotent (config-cli reconciles the realm to spec).
    image:
      registry: docker.io
      repository: bitnamilegacy/keycloak-config-cli
      tag: 6.4.0-debian-12-r11
    configuration:
      sovereign-realm.json: |
        {
          "realm": "sovereign",
          "enabled": true,
          "displayName": "Sovereign",
          "sslRequired": "external",
          "registrationAllowed": false,
          "loginWithEmailAllowed": true,
          "duplicateEmailsAllowed": false,
          "resetPasswordAllowed": true,
          "editUsernameAllowed": false,
          "bruteForceProtected": true,
          "accessTokenLifespan": 900,
          "ssoSessionIdleTimeout": 1800,
          "ssoSessionMaxLifespan": 28800,
          "defaultGroups": [
            "/sovereign-viewers"
          ],
          "groups": [
            { "name": "sovereign-admins" },
            { "name": "sovereign-ops" },
            { "name": "sovereign-viewers" }
          ],
          "clientScopes": [
            {
              "name": "groups",
              "protocol": "openid-connect",
              "attributes": {
                "include.in.token.scope": "true",
                "display.on.consent.screen": "true"
              },
              "protocolMappers": [
                {
                  "name": "groups",
                  "protocol": "openid-connect",
                  "protocolMapper": "oidc-group-membership-mapper",
                  "consentRequired": false,
                  "config": {
                    "full.path": "false",
                    "id.token.claim": "true",
                    "access.token.claim": "true",
                    "claim.name": "groups",
                    "userinfo.token.claim": "true"
                  }
                }
              ]
            }
          ],
          "clients": [
            {
              "clientId": "kubectl",
              "name": "kubectl (per-Sovereign K8s api-server OIDC client)",
              "description": "Public OIDC client used by customer admins to authenticate kubectl against the Sovereign's k3s api-server (issue #326).",
              "enabled": true,
              "publicClient": true,
              "standardFlowEnabled": true,
              "directAccessGrantsEnabled": true,
              "implicitFlowEnabled": false,
              "serviceAccountsEnabled": false,
              "redirectUris": [
                "http://localhost:8000",
                "http://localhost:8000/*",
                "urn:ietf:wg:oauth:2.0:oob"
              ],
              "webOrigins": [
                "+"
              ],
              "defaultClientScopes": [
                "web-origins",
                "acr",
                "profile",
                "roles",
                "email",
                "groups"
              ],
              "optionalClientScopes": [
                "address",
                "phone",
                "offline_access",
                "microprofile-jwt"
              ],
              "attributes": {
                "pkce.code.challenge.method": "S256",
                "access.token.lifespan": "900"
              }
            }
          ]
        }
  # Metrics + ServiceMonitor + PrometheusRule — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). The upstream
  # bitnami/keycloak chart's `metrics.serviceMonitor.enabled` and
  # `metrics.prometheusRule.enabled` render monitoring.coreos.com/v1
  # resources which the apiserver rejects on a fresh Sovereign before
  # bp-kube-prometheus-stack ships the CRDs. Upstream already defaults
  # all three to false — set explicitly so a future upstream bump cannot
  # regress this. Operator opts in via per-cluster overlay (issue #182).
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
    prometheusRule:
      enabled: false

# ─── Catalyst HTTPRoute (Cilium Gateway API, issue #387) ──────────────────
# Replaces the upstream chart's networking.k8s.io/v1.Ingress on Sovereigns.
# Per-Sovereign overlay supplies `gateway.host` (e.g. auth.<sovereign-fqdn>).
# parentRef defaults to cilium-gateway/kube-system, the per-Sovereign
# Gateway shipped by clusters/_template/bootstrap-kit/01-cilium.yaml.
gateway:
  enabled: true
  # host: auth.<sovereign-fqdn> — REQUIRED, no default per Inviolable Principle #4
  host: ""
  path: "/"
  # Backend Service — defaults to <release>-keycloak (bitnami subchart fullname)
  backendService: ""
  backendPort: 80
  parentRef:
    name: cilium-gateway
    namespace: kube-system
    sectionName: https
