---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage

    # Proxy service - OIDC via Pocket ID
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
        auto_provision_accounts: true
        user_oidc_claim: preferred_username
      enable_basic_auth: false

    # IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
    idm:
      service_user_passwords:
        admin_password: ${OC_IDM_ADMIN_PASSWORD}
        idm_password: ${OC_IDM_IDM_PASSWORD}
        reva_password: ${OC_IDM_REVA_PASSWORD}
        idp_password: ${OC_IDM_IDP_PASSWORD}

    # Gateway service - storage configuration
    gateway:
      storage_registry:
        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

  csp.yaml: |
    directives:
      connect-src:
        - "'self'"
        - "blob:"
        - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
        - "https://update.opencloud.eu/"
        - "https://opencloud.basicstack.de"
        - "https://auth.basicstack.de"
        - "wss://opencloud.basicstack.de"
        - "wss://auth.basicstack.de"