# --- Authentik Helm Configuration ---
# Uses CloudNative-PG cluster (authentik-db) for PostgreSQL

global:
  env:
    - name: AUTHENTIK_POSTGRESQL__HOST
      value: "authentik-db-rw.auth.svc.cluster.local"
    - name: AUTHENTIK_POSTGRESQL__NAME
      value: "authentik"
    - name: AUTHENTIK_POSTGRESQL__USER
      value: "authentik"
    - name: AUTHENTIK_POSTGRESQL__PASSWORD
      valueFrom:
        secretKeyRef:
          name: authentik-db-app
          key: password

authentik:
  # Secret key for cookie signing and session encryption
  secret_key: "gU2ohe8eighaiph4quaeCh1ieM3iechoh2ohNg5yahz6eephoh"
  error_reporting:
    enabled: false
  log_level: info

server:
  replicas: 1
  resources:
    requests:
      cpu: 100m
      memory: 384Mi
    limits:
      memory: 768Mi

  ingress:
    enabled: true
    ingressClassName: "traefik"
    annotations:
      kubernetes.io/ingress.class: "traefik"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      kubernetes.io/tls-acme: "true"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-body-size: "0"
    hosts:
      - auth.haumdaucher.de
    tls:
      - hosts:
          - auth.haumdaucher.de
        secretName: auth-haumdaucher-de

worker:
  replicas: 1
  resources:
    requests:
      cpu: 100m
      memory: 384Mi
    limits:
      memory: 768Mi

# Disable bundled subchart databases (managed by CNPG)
postgresql:
  enabled: false