---
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-config
  namespace: opencloud
data:
  opencloud.yaml: |
    # OpenCloud Complete Configuration
    # Generated from 'opencloud init' and customized with our secrets

    # Core secrets (from our SealedSecrets via environment variables)
    token_manager:
      jwt_secret: ${OC_TOKEN_MANAGER_JWT_SECRET}

    machine_auth_api_key: ${OC_MACHINE_AUTH_API_KEY}
    system_user_api_key: ${OC_SYSTEM_USER_API_KEY}
    transfer_secret: ${OC_TRANSFER_SECRET}
    url_signing_secret: ${OC_URL_SIGNING_SECRET}
    system_user_id: ${OC_SYSTEM_USER_ID}
    admin_user_id: ${OC_ADMIN_USER_ID}

    # Graph service
    graph:
      application:
        id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
      events:
        tls_insecure: true
      spaces:
        insecure: true
      identity:
        ldap:
          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # IDP service
    idp:
      ldap:
        bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}

    # IDM service
    idm:
      service_user_passwords:
        admin_password: ${OC_IDM_ADMIN_PASSWORD}
        idm_password: ${OC_IDM_IDM_PASSWORD}
        reva_password: ${OC_IDM_REVA_PASSWORD}
        idp_password: ${OC_IDM_IDP_PASSWORD}

    # Collaboration services
    collaboration:
      wopi:
        secret: ${OC_COLLABORATION_WOPI_SECRET}
      app:
        insecure: true

    # Proxy service (OIDC integration)
    proxy:
      oidc:
        issuer: https://auth.basicstack.de
        insecure: false
      insecure_backends: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Frontend service
    frontend:
      app_handler:
        insecure: true
      archiver:
        insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
      ocdav:
        insecure: true

    # Auth services
    auth_basic:
      auth_providers:
        ldap:
          bind_password: ${OC_AUTH_BASIC_LDAP_BIND_PASSWORD}

    auth_bearer:
      auth_providers:
        oidc:
          insecure: false

    # User/Group services
    users:
      drivers:
        ldap:
          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}

    groups:
      drivers:
        ldap:
          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}

    # OCM (Open Cloud Mesh)
    ocm:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Thumbnails
    thumbnails:
      thumbnail:
        transfer_secret: ${OC_THUMBNAILS_TRANSFER_SECRET}
        webdav_allow_insecure: true
        cs3_allow_insecure: true

    # Search service
    search:
      events:
        tls_insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Audit service
    audit:
      events:
        tls_insecure: true

    # Settings service
    settings:
      service_account_ids:
      - ${OC_SERVICE_ACCOUNT_ID}

    # Sharing service
    sharing:
      events:
        tls_insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Storage Users
    storage_users:
      events:
        tls_insecure: true
      mount_id: ${OC_STORAGE_MOUNT_ID}
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Notifications
    notifications:
      notifications:
        events:
          tls_insecure: true
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # NATS
    nats:
      nats:
        tls_skip_verify_client_cert: true

    # Gateway
    gateway:
      storage_registry:
        storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}

    # Userlog
    userlog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Auth Service
    auth_service:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Client Log
    clientlog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}

    # Activity Log
    activitylog:
      service_account:
        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}