{{- if and .Values.api.enabled .Values.api.oidc.enabled .Values.api.oidc.dex.enabled }}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: kargo-dex-server
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.dexServer.labels" . | nindent 4 }}
stringData:
  config.yaml: |-
    {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
    issuer: https://{{ .Values.api.host }}/dex
    {{- else }}
    issuer: http://{{ .Values.api.host }}/dex
    {{- end }}

    storage:
      type: memory

    web:
      https: 0.0.0.0:5556
      tlsCert: /etc/dex/tls.crt
      tlsKey: /etc/dex/tls.key
    telemetry:
      http: 0.0.0.0:5558

    oauth2:
      skipApprovalScreen: {{ .Values.api.oidc.dex.skipApprovalScreen | default "true" }}

    staticClients:
    - id: {{ quote .Values.api.host }}
      name: Kargo
      public: true
      {{- if not (hasPrefix "localhost:" .Values.api.host) }}
      redirectURIs:
      {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
      - https://{{ .Values.api.host }}/login
      {{- else }}
      - http://{{ .Values.api.host }}/login
      {{- end }}
      {{- end }}
    - id: {{ .Values.api.host }}-cli
      name: Kargo CLI
      public: true

    connectors:
    {{- toYaml .Values.api.oidc.dex.connectors | nindent 4 }}
{{- end }}
