# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
# THIS Secret, so ALL OIDC env (OIDC_CLIENT_ID/OIDC_CLIENT_SECRET/OIDC_ISSUER_URL/OIDC_SCOPES/OIDC_CALLBACK_URL) live here,
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart `envFrom`s this Secret VERBATIM, so
# the KEYS ARE the container env var names — they MUST be exactly OIDC_CLIENT_ID / OIDC_CLIENT_SECRET
# / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (the chart's `-oidc-*` args reference those
# names via $(...)). There is NO camelCase→OIDC_ mapping; a mismatched key breaks OIDC login.
#
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
# Keycloak `headlamp` client) — same cross-namespace mirror pattern as grafana/gitea (a Secret
# cannot be shared across namespaces, so the one value is stored in two encrypted files).
#
# HAND-OFF STEPS (operator):
#  (a) Use the SAME headlamp-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
#  (b) Copy to:      platform/headlamp/headlamp-oidc-credentials.sops.yaml
#  (c) Fill `clientSecret`; encrypt:
#         sops -e -i platform/headlamp/headlamp-oidc-credentials.sops.yaml
#  (d) It is already listed under `resources:` in platform/headlamp/kustomization.yaml.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: headlamp-oidc
  namespace: headlamp
type: Opaque
stringData:
  # KEY NAMES ARE LOAD-BEARING. The chart does NOT rename these — it `envFrom`s this Secret
  # verbatim, so each key becomes a container env var of the SAME name, and the chart's OIDC args
  # reference them by exact name: `-oidc-client-id=$(OIDC_CLIENT_ID)`,
  # `-oidc-client-secret=$(OIDC_CLIENT_SECRET)`, `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`,
  # `-oidc-scopes=$(OIDC_SCOPES)`. If a key is misnamed (e.g. camelCase `issuerURL`), the env var
  # `OIDC_ISSUER_URL` is undefined, K8s leaves the literal string `$(OIDC_ISSUER_URL)` in the arg,
  # and Headlamp's OIDC discovery fails with `unsupported protocol scheme ""`. Use these EXACT keys.
  # Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
  OIDC_CLIENT_ID: headlamp
  OIDC_ISSUER_URL: https://keycloak.home.keithjackson.dev/realms/homelab
  OIDC_SCOPES: "openid email profile"
  OIDC_CALLBACK_URL: https://headlamp.home.keithjackson.dev/oidc-callback
  # The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
  OIDC_CLIENT_SECRET: REPLACE-ME