---
kind: ConfigMap
apiVersion: v1
metadata:
  name: dex
data:
  config.yaml: |
    issuer: https://dex.pulsifer.dev
    storage:
      type: kubernetes
      config:
        inCluster: true
    web:
      https: 0.0.0.0:443
      tlsCert: /etc/dex/tls/tls.crt
      tlsKey: /etc/dex/tls/tls.key
    connectors:
    - type: oidc
      id: google
      name: google
      config:
        # Canonical URL of the provider, also used for configuration discovery.
        # This value MUST match the value returned in the provider config discovery.
        #
        # See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
        issuer: https://accounts.google.com

        # Connector config values starting with a "$" will read from the environment.
        clientID: $GOOGLE_CLIENT_ID
        clientSecret: $GOOGLE_CLIENT_SECRET

        # Dex's issuer URL + "/callback"
        redirectURI: https://dex.pulsifer.dev/callback

        # Some providers require passing client_secret via POST parameters instead
        # of basic auth, despite the OAuth2 RFC discouraging it. Many of these
        # cases are caught internally, but some may need to uncommented the
        # following field.
        #
        # basicAuthUnsupported: true

        hostedDomains:
         - pulsifer.dev
         - pulsifer.ca
         - lolwtf.ca

        scopes:
         - profile
         - email
         - openid
    oauth2:
      skipApprovalScreen: false
    staticClients:
    - id: lab-poptarts
      redirectURIs:
      - 'https://lab.pulsifer.dev/callback'
      name: 'Poptart Space cat'
      secret: thehomelabisthedopestlab
    enablePasswordDB: true
    staticPasswords:
    - email: "bobby.tables@pulsifer.dev"
      # bcrypt hash of the string "password"
      hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
      username: "Bobby Tables"
      userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
