# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
# THIS Secret, so ALL OIDC env (clientID/clientSecret/issuerURL/scopes/callbackURL) live here,
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart maps these keys to the container's
# OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL env vars.
#
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
# Keycloak `headlamp` client) — same cross-namespace mirror pattern as grafana/gitea (a Secret
# cannot be shared across namespaces, so the one value is stored in two encrypted files).
#
# HAND-OFF STEPS (operator):
#  (a) Use the SAME headlamp-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
#  (b) Copy to:      platform/headlamp/headlamp-oidc-credentials.sops.yaml
#  (c) Fill `clientSecret`; encrypt:
#         sops -e -i platform/headlamp/headlamp-oidc-credentials.sops.yaml
#  (d) It is already listed under `resources:` in platform/headlamp/kustomization.yaml.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: headlamp-oidc
  namespace: headlamp
type: Opaque
stringData:
  # Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
  clientID: headlamp
  issuerURL: https://keycloak.home.keithjackson.dev/realms/homelab
  scopes: "openid email profile"
  callbackURL: https://headlamp.home.keithjackson.dev/oidc-callback
  # The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
  clientSecret: REPLACE-ME