---
# Pangolin ConfigMap
# The `postgres.connection_string` placeholder is replaced at pod startup
# by the render-config init container using DATABASE_URL from the sealed
# secret. See pangolin-deployment.yaml.
apiVersion: v1
kind: ConfigMap
metadata:
  name: pangolin-config
  namespace: pangolin
data:
  config.yml.tmpl: |
    gerbil:
      start_port: 10000
      base_endpoint: "pangolin.basicstack.de"

    app:
      dashboard_url: "https://pangolin.basicstack.de"
      log_level: "info"

    domains:
      domain1:
        base_domain: "basicstack.de"

    server:
      secret: "REPLACE_WITH_SECRET_FROM_SEALED_SECRET"
      # DEV-457: Traefik runs in kube-system; the short hostname "pangolin"
      # (Pangolin's default) doesn't resolve there. Point badger + internal
      # callbacks at the FQDN so the badger middleware can call back to the
      # Pangolin API.
      internal_hostname: "pangolin.pangolin.svc.cluster.local"
      badger_override: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1"
      cors:
        origins:
          - "https://pangolin.basicstack.de"

    flags:
      signup: true
      verification: false

    postgres:
      connection_string: "__DATABASE_URL__"

    oidc:
      enabled: true
      issuer: "https://auth.basicstack.de"
      callback_url: "https://pangolin.basicstack.de/auth/callback"
      scopes: "openid profile email groups"