---
# Stalwart OIDC Configuration
# This ConfigMap configures Pocket ID as the OAuth provider for Stalwart Mail Server

apiVersion: v1
kind: ConfigMap
metadata:
  name: stalwart-oidc-config
  namespace: mail
data:
  oauth.toml: |
    # OAuth/OIDC Configuration for Pocket ID
    [oauth]

    # OAuth provider configuration
    [oauth.pocket-id]
    issuer-url = "https://auth.basicstack.de"
    client-id = "19432b61-e27e-444d-9ff0-0fa23fdac6d7"
    client-secret = "***REMOVED***"

    # OAuth endpoints (auto-discovered from issuer-url)
    authorization-endpoint = "https://auth.basicstack.de/api/oidc/authorize"
    token-endpoint = "https://auth.basicstack.de/api/oidc/token"
    userinfo-endpoint = "https://auth.basicstack.de/api/oidc/userinfo"

    # Scopes to request
    scopes = ["openid", "profile", "email"]

    # Callback URL (must match what's configured in Pocket ID)
    redirect-uri = "https://mail.basicstack.de/login/oauth"

    # User attribute mapping
    [oauth.pocket-id.user-mapping]
    username = "preferred_username"
    email = "email"
    name = "name"
---
# Secret for OAuth client credentials
apiVersion: v1
kind: Secret
metadata:
  name: stalwart-oidc-secret
  namespace: mail
type: Opaque
stringData:
  client-id: "19432b61-e27e-444d-9ff0-0fa23fdac6d7"
  client-secret: "***REMOVED***"