---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Complete Configuration
    # Generated from 'opencloud init' and customized with our secrets

    # Core secrets (from our SealedSecrets via environment variables)
    token_manager:
      jwt_secret: ${OC_TOKEN_MANAGER_JWT_SECRET}

    machine_auth_api_key: ${OC_MACHINE_AUTH_API_KEY}
    system_user_api_key: ${OC_SYSTEM_USER_API_KEY}
    transfer_secret: ${OC_TRANSFER_SECRET}
    url_signing_secret: ${OC_URL_SIGNING_SECRET}
    system_user_id: ${OC_SYSTEM_USER_ID}
    admin_user_id: ${OC_ADMIN_USER_ID}

    # Graph service (using internal IDM LDAP for user storage)
    graph:
      application:
        id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
      events:
        tls_insecure: true
      spaces:
        insecure: true
      identity:
        ldap:
          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # IDP service excluded (using external OIDC via Pocket ID for authentication)
    # idp:
    #   ldap:
    #     bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}

    # IDM service (needed for user storage even with external OIDC)
    idm:
      service_user_passwords:
        admin_password: ${OC_IDM_ADMIN_PASSWORD}
        idm_password: ${OC_IDM_IDM_PASSWORD}
        reva_password: ${OC_IDM_REVA_PASSWORD}
        idp_password: ${OC_IDM_IDP_PASSWORD}

    # Collaboration services
    collaboration:
      wopi:
        secret: ${OC_COLLABORATION_WOPI_SECRET}
      app:
        insecure: true

    # Proxy service (OIDC integration with auto-provisioning)
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
        auto_provision_accounts: true
        user_oidc_claim: email
        role_assignment:
          driver: oidc
          oidc_role_mapper:
            role_claim: groups
            role_mapping:
              - role_name: admin
                claim_value: opencloudAdmin
              - role_name: spaceadmin
                claim_value: opencloudSpaceAdmin
              - role_name: user
                claim_value: opencloudUser
              - role_name: guest
                claim_value: opencloudGuest
      enable_basic_auth: false
      insecure_backends: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Frontend service
    frontend:
      app_handler:
        insecure: true
      archiver:
        insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
      ocdav:
        insecure: true

    # Auth services (OIDC only, no basic auth)
    auth_bearer:
      auth_providers:
        oidc:
          insecure: false

    # User/Group services (using LDAP driver connected to internal IDM)
    users:
      drivers:
        ldap:
          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}

    groups:
      drivers:
        ldap:
          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}

    # OCM (Open Cloud Mesh)
    ocm:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Thumbnails
    thumbnails:
      thumbnail:
        transfer_secret: ${OC_THUMBNAILS_TRANSFER_SECRET}
        webdav_allow_insecure: true
        cs3_allow_insecure: true

    # Search service - DISABLED due to crashes in v7.2.0
    # See: https://github.com/opencloud-eu/opencloud/issues/1740
    # search:
    #   engine:
    #     type: bleve
    #     bleve:
    #       data_path: /var/lib/opencloud/search
    #   extractor:
    #     type: tika
    #     tika:
    #       tika_url: http://tika:9998
    #   events:
    #     tls_insecure: true
    #   service_account:
    #     service_account_id: ${OC_SERVICE_ACCOUNT_ID}
    #     service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Audit service
    audit:
      events:
        tls_insecure: true

    # Settings service
    settings:
      service_account_ids:
      - ${OC_SERVICE_ACCOUNT_ID}

    # Sharing service
    sharing:
      events:
        tls_insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Storage Users
    storage_users:
      events:
        tls_insecure: true
      mount_id: ${OC_STORAGE_MOUNT_ID}
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Notifications
    notifications:
      notifications:
        events:
          tls_insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # NATS
    nats:
      nats:
        tls_skip_verify_client_cert: true

    # Gateway
    gateway:
      storage_registry:
        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

    # Userlog
    userlog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Auth Service
    auth_service:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Client Log
    clientlog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Activity Log
    activitylog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}