# Keycloak Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
#
# replicaCount: ${KEYCLOAK_REPLICAS}          # overlay knob (dev 1 / prod 2 HA)
# postgresql on longhorn                       # DR-critical (ADR-0014), backed up off-cluster
# auth.existingSecret: keycloak-admin-credentials   (SOPS-encrypted, WS-SEC — name only)
# realm/clients/groups as code                 # keycloak-config-cli / realm-import (Phase 6)
# public (hardened) exposure so login flows work for internet-exposed services (ADR-0014).
# Exceptions (do NOT force SSO): Plex/Seerr (Plex auth), Minecraft (Mojang), UniFi (native).