---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Minimal Configuration
    # Only non-default settings - environment variables override these
    # Using built-in IDM for user/group storage (IDM provides internal LDAP on localhost:9125)

    # Graph service - connect to IDM's internal LDAP server
    graph:
      identity:
        ldap:
          uri: ldap://localhost:9125
          base_dn: o=libregraph-idm
          insecure: true
          bind_dn: uid=libregraph,ou=sysusers,o=libregraph-idm
          bind_password: ${OC_IDM_IDM_PASSWORD}
          user_base_dn: ou=users,o=libregraph-idm
          group_base_dn: ou=groups,o=libregraph-idm

    # Proxy service - OIDC configuration (already in env vars, kept for reference)
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
        auto_provision_accounts: true
        user_oidc_claim: preferred_username
      enable_basic_auth: false

    # Users service - connect to IDM's internal LDAP
    users:
      drivers:
        ldap:
          uri: ldap://localhost:9125
          base_dn: o=libregraph-idm
          insecure: true
          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
          bind_password: ${OC_IDM_REVA_PASSWORD}
          user_base_dn: ou=users,o=libregraph-idm
          user_filter: (objectClass=inetOrgPerson)
          user_object_class: inetOrgPerson

    # Groups service - connect to IDM's internal LDAP
    groups:
      drivers:
        ldap:
          uri: ldap://localhost:9125
          base_dn: o=libregraph-idm
          insecure: true
          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
          bind_password: ${OC_IDM_REVA_PASSWORD}
          group_base_dn: ou=groups,o=libregraph-idm
          group_filter: (objectClass=groupOfNames)
          group_object_class: groupOfNames

    # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
    idm:
      service_user_passwords:
        admin_password: ${OC_IDM_ADMIN_PASSWORD}
        idm_password: ${OC_IDM_IDM_PASSWORD}
        reva_password: ${OC_IDM_REVA_PASSWORD}
        idp_password: ${OC_IDM_IDP_PASSWORD}

    # Gateway service - storage configuration
    gateway:
      storage_registry:
        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

  csp.yaml: |
    directives:
      connect-src:
        - "'self'"
        - "blob:"
        - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
        - "https://update.opencloud.eu/"
        - "https://opencloud.basicstack.de"
        - "https://auth.basicstack.de"
        - "wss://opencloud.basicstack.de"
        - "wss://auth.basicstack.de"