---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Minimal Configuration
    # Only non-default settings - environment variables override these

    # Graph service - external OpenLDAP configuration
    graph:
      identity:
        ldap:
          uri: ldap://openldap.opencloud.svc.cluster.local:389
          base_dn: dc=basicstack,dc=de
          bind_dn: cn=admin,dc=basicstack,dc=de
          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
          user_base_dn: ou=users,dc=basicstack,dc=de
          group_base_dn: ou=groups,dc=basicstack,dc=de
          insecure: true

    # Proxy service - OIDC configuration (already in env vars, kept for reference)
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
        auto_provision_accounts: true
        user_oidc_claim: preferred_username
      enable_basic_auth: false

    # Users service - external LDAP
    users:
      drivers:
        ldap:
          uri: ldap://openldap.opencloud.svc.cluster.local:389
          base_dn: dc=basicstack,dc=de
          bind_dn: cn=admin,dc=basicstack,dc=de
          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
          user_base_dn: ou=users,dc=basicstack,dc=de
          user_filter: (objectClass=inetOrgPerson)
          user_object_class: inetOrgPerson
          insecure: true

    # Groups service - external LDAP
    groups:
      drivers:
        ldap:
          uri: ldap://openldap.opencloud.svc.cluster.local:389
          base_dn: dc=basicstack,dc=de
          bind_dn: cn=admin,dc=basicstack,dc=de
          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
          group_base_dn: ou=groups,dc=basicstack,dc=de
          group_filter: (objectClass=groupOfNames)
          group_object_class: groupOfNames
          insecure: true

    # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
    idm:
      service_user_passwords:
        admin_password: ${OC_IDM_ADMIN_PASSWORD}
        idm_password: ${OC_IDM_IDM_PASSWORD}
        reva_password: ${OC_IDM_REVA_PASSWORD}
        idp_password: ${OC_IDM_IDP_PASSWORD}

    # Gateway service - storage configuration
    gateway:
      storage_registry:
        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

  csp.yaml: |
    directives:
      connect-src:
        - "'self'"
        - "blob:"
        - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
        - "https://update.opencloud.eu/"
        - "https://opencloud.basicstack.de"
        - "https://auth.basicstack.de"
        - "wss://opencloud.basicstack.de"
        - "wss://auth.basicstack.de"