---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Base Configuration
    # Uses bash substitution to inject secrets from environment variables

    # Core secrets (injected via environment variables)
    token_manager:
      jwt_secret: ${OC_TOKEN_MANAGER_JWT_SECRET}

    machine_auth_api_key: ${OC_MACHINE_AUTH_API_KEY}
    system_user_api_key: ${OC_SYSTEM_USER_API_KEY}
    transfer_secret: ${OC_TRANSFER_SECRET}
    url_signing_secret: ${OC_URL_SIGNING_SECRET}

    system_user_id: ${OC_SYSTEM_USER_ID}
    admin_user_id: ${OC_ADMIN_USER_ID}

    # OIDC configuration
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
      user_oidc_claim: preferred_username
      user_cs3_claim: username

    # Disable demo users
    idm:
      create_demo_users: false

    # Graph service configuration
    graph:
      assign_default_user_role: false
      username_match: none
      application:
        id: ${OC_GRAPH_APPLICATION_ID:-a72387e1-fb22-49c9-9c94-12ff0abf9b38}
      events:
        tls_insecure: true
      spaces:
        insecure: true

    # Gateway configuration
    gateway:
      storage_users_mount_id: ${STORAGE_USERS_MOUNT_ID:-/users}

    # Storage configuration
    storage_users:
      mount_id: ${STORAGE_USERS_MOUNT_ID:-/users}