---
# Pangolin ConfigMap
# The `postgres.connection_string` placeholder is replaced at pod startup
# by the render-config init container using DATABASE_URL from the sealed
# secret. See pangolin-deployment.yaml.
apiVersion: v1
kind: ConfigMap
metadata:
  name: pangolin-config
  namespace: pangolin
data:
  config.yml.tmpl: |
    gerbil:
      start_port: 10000
      base_endpoint: "pangolin.basicstack.de"

    app:
      dashboard_url: "https://pangolin.basicstack.de"
      log_level: "info"

    domains:
      domain1:
        base_domain: "basicstack.de"

    server:
      secret: "REPLACE_WITH_SECRET_FROM_SEALED_SECRET"
      cors:
        origins:
          - "https://pangolin.basicstack.de"

    flags:
      signup: true
      verification: false

    postgres:
      connection_string: "__DATABASE_URL__"

    oidc:
      enabled: true
      issuer: "https://auth.basicstack.de"
      callback_url: "https://pangolin.basicstack.de/auth/callback"
      scopes: "openid profile email groups"