Initial commit

2026-10-23 18:15:49 -04:00
commit 935b3e9f4c
18 changed files with 909 additions and 0 deletions
@@ -0,0 +1,65 @@
+---
+dex_namespace: dex
+dex_release_name: dex
+dex_chart_version: "0.26.0"
+dex_issuer: "https://{{ dex_hostname }}/"
+dex_hostname: dex.example.com
+dex_ingress_class: nginx
+dex_cluster_issuer: letsencrypt-prod
+dex_tls_secret_name: dex
+dex_wait_timeout: 600s
+dex_image_tag: ""  # Empty uses the pinned chart's application version.
+dex_image_pull_secrets: []
+dex_resources:
+  requests: {cpu: 100m, memory: 128Mi}
+  limits: {cpu: "1", memory: 512Mi}
+
+# Reuse the existing postgresql release/PVC. Never upgrade it implicitly.
+dex_postgres_manage: false
+dex_postgres_release_name: postgresql
+dex_postgres_chart_version: ""  # Required if explicitly managing Bitnami PostgreSQL.
+dex_postgres_storage_size: 10Gi
+dex_postgres_host: postgresql
+dex_postgres_port: 5432
+dex_postgres_database: dex
+dex_postgres_user: dex
+dex_postgres_password: ""
+dex_postgres_admin_password: ""
+dex_postgres_ssl_mode: disable
+
+# Preserve legacy internal plaintext LDAP behavior. TLS is explicitly opt-in.
+# Plaintext exposes bind/user passwords; restrict this traffic to trusted networks.
+dex_ldap_host: ldap.example.com:389
+dex_ldap_insecure_no_ssl: true
+dex_ldap_start_tls: false
+dex_ldap_bind_dn: cn=readonly,dc=example,dc=com
+dex_ldap_bind_password: ""
+dex_ldap_root_ca: ""
+dex_ca_secret_name: ""
+dex_ldap_connector_id: ldap
+dex_ldap_connector_name: Account
+dex_ldap_user_base_dn: ou=people,dc=example,dc=com
+dex_ldap_user_filter: "(objectClass=inetOrgPerson)"
+dex_ldap_id_attribute: uid
+dex_ldap_name_attribute: cn
+dex_ldap_group_base_dn: ou=groups,dc=example,dc=com
+# groupOfUniqueNames stores full user DNs in uniqueMember.
+dex_ldap_group_user_attribute: DN
+dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
+
+# Optional legacy Matrix convenience client. Configure its ID/secret explicitly.
+dex_matrix_client_enabled: false
+dex_matrix_redirect_uris: []
+# Full objects (id, name, secret or secretEnv, redirectURIs). Use Vault for secrets.
+dex_static_clients: []
+# Additional connectors let www use entryUUID without changing legacy subjects.
+dex_additional_connectors: []
+# Optional environment Secret for secretEnv and $ENV connector credentials.
+dex_env_secret_name: ""
+dex_extra_volumes: []
+dex_extra_volume_mounts: []
+
+# eom.dev artwork is opt-in via the deployment playbook.
+dex_theme_enabled: false
+dex_brand_name: Dex
+dex_theme_configmap_name: dex-catppuccin