---
# Keycloak — platform IdP (OIDC + SAML), config-as-code, PostgreSQL on Longhorn (ADR-0014).
# Phase 0 STUB. DR-CRITICAL: DB backed up off-cluster; documented break-glass local-admin path.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: keycloak
  namespace: keycloak
spec:
  interval: 30m
  chart:
    spec:
      chart: keycloak
      version: ">=24.0.0 <25.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: bitnami
        namespace: keycloak
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    replicaCount: ${KEYCLOAK_REPLICAS}       # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
    production: true                          # TLS/proxy-aware; served behind the Gateway (public)
    proxyHeaders: xforwarded
    # PostgreSQL on Longhorn (ADR-0014) — DR-critical, backed up off-cluster (velero/).
    postgresql:
      enabled: true
      primary:
        persistence:
          storageClass: longhorn
    # Admin + DB credentials: SOPS-encrypted secrets referenced BY NAME only (WS-SEC, ADR-0007).
    auth:
      existingSecret: keycloak-admin-credentials
    # TODO(WS-SEC, Phase 6): realms/clients/groups as code (keycloak-config-cli / realm-import);
    #   MFA for privileged groups; break-glass local-admin path (e.g. on Gitea). Onboarded EARLY
    #   (with PiHole/Gitea) so later services adopt SSO as they come up (roadmap Phase 6).