apiVersion: v1
kind: Secret
metadata:
  name: ory-kratos
  namespace: deeploy
type: Opaque
stringData:
  DSN: 'postgres://{{ .Values.database.username }}:{{ .Values.database.password }}@{{ .Values.database.host }}:{{ .Values.database.port }}/deeploy_kratos'
  kratos.yaml: |-
    dsn: postgres://{{ .Values.database.username }}:{{ .Values.database.password }}@{{ .Values.database.host }}:{{ .Values.database.port }}/deeploy_kratos
    identity:
      default_schema_url: file:///etc/config/user.schema.json
    selfservice:
      default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/
      whitelisted_return_urls:
        - http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/
        - http{{- if .Values.security.tls.enabled -}}s{{- end -}}://*.{{ .Values.host }}/
        - http://localhost:4200/
      methods:
        password:
          enabled: true
      flows:
        logout:
          after:
            default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/
        settings:
          lifespan: 1h
          privileged_session_max_age: 1h
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/account/edit
          after:
            default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/account/edit?success=true
        verification:
          enabled: true
          lifespan: 1h
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/verify
          after:
            default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/verify?success=true
        login:
          lifespan: 1h
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/login
          after:
            default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/
        registration:
          lifespan: 10m
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/register
          after:
            default_browser_return_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/
            password:
              hooks:
                - hook: session
        error:
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/error
        recovery:
          enabled: true
          ui_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://{{ .Values.host }}/recovery
    courier:
      smtp:
        connection_uri: smtps://{{ .Values.email.username }}:{{ .Values.email.password }}@{{ .Values.email.smtpHost }}:{{ .Values.email.port }}?skip_ssl_verify=true
        from_address: {{ .Values.email.fromAddress }}
      template_override_path: /home/ory/courier/templates
    serve:
      admin:
        host: 0.0.0.0
        port: 4434
        base_url: http://ory-kratos.deeploy:8080/
      public:
        host: 0.0.0.0
        port: 4433
        base_url: http{{- if .Values.security.tls.enabled -}}s{{- end -}}://api.{{ .Values.host }}/v1/auth/
    secrets:
      default:
        - bdH49tgohoBgYDrbeROj19EWdH
    hashers:
      argon2:
        parallelism: 1
        memory: "128MB"
        iterations: 2
        salt_length: 16
        key_length: 16
  user.schema.json: |-
    {
      "$id": "file:///etc/config/user.schema.json",
      "$schema": "http://json-schema.org/draft-07/schema#",
      "title": "User",
      "type": "object",
      "properties": {
        "traits": {
          "type": "object",
          "properties": {
            "email": {
              "title": "E-Mail",
              "type": "string",
              "format": "email",
              "ory.sh/kratos": {
                "credentials": {
                  "password": {
                    "identifier": true
                  }
                },
                "verification": {
                  "via": "email"
                },
                "recovery": {
                  "via": "email"
                }
              }
            },
            "firstName": {
              "type": "string"
            },
            "lastName": {
              "type": "string"
            },
            "role": {
              "type": "string"
            },
            "preferences": {
              "type": "object",
              "properties": { 
                "defaultWorkspaceId": {
                  "type": "string"
                },
                "language": {
                  "type": "string",
                  "default": "en"
                },
                "workspaceDeploymentsOrder": {
                  "type": "object"
                },
                "darkMode": {
                  "type": "boolean",
                  "default": "false"
                }
              }
            }
          },
          "required": ["email", "firstName", "lastName"],
          "additionalProperties": false
        }
      }
    }
