---
# Stalwart OIDC Configuration
# This ConfigMap configures Pocket ID as the OAuth provider for Stalwart Mail Server

apiVersion: v1
kind: ConfigMap
metadata:
  name: stalwart-oidc-config
  namespace: mail
data:
  oauth.toml: |
    # OAuth/OIDC Configuration for Pocket ID
    [oauth]

    # OAuth provider configuration
    [oauth.pocket-id]
    issuer-url = "https://auth.basicstack.de"
    # client-id and client-secret loaded from SealedSecret: stalwart-oidc-sealed.yaml
    client-id = "REPLACED_BY_SECRET"
    client-secret = "REPLACED_BY_SECRET"

    # OAuth endpoints (auto-discovered from issuer-url)
    authorization-endpoint = "https://auth.basicstack.de/api/oidc/authorize"
    token-endpoint = "https://auth.basicstack.de/api/oidc/token"
    userinfo-endpoint = "https://auth.basicstack.de/api/oidc/userinfo"

    # Scopes to request
    scopes = ["openid", "profile", "email"]

    # Callback URL (must match what's configured in Pocket ID)
    redirect-uri = "https://mail.basicstack.de/login/oauth"

    # User attribute mapping
    [oauth.pocket-id.user-mapping]
    username = "preferred_username"
    email = "email"
    name = "name"
---
# Secret managed via SealedSecrets
# See: stalwart-oidc-sealed.yaml