---
dex_namespace: dex
dex_release_name: dex
dex_chart_version: "0.26.0"
dex_issuer: "https://{{ dex_hostname }}/"
dex_hostname: dex.example.com
dex_ingress_class: nginx
dex_cluster_issuer: letsencrypt-prod
dex_tls_secret_name: dex
dex_wait_timeout: 600s
dex_image_tag: ""  # Empty uses the pinned chart's application version.
dex_image_pull_secrets: []
dex_resources:
  requests: {cpu: 100m, memory: 128Mi}
  limits: {cpu: "1", memory: 512Mi}

# Reuse the existing postgresql release/PVC. Never upgrade it implicitly.
dex_postgres_manage: false
dex_postgres_release_name: postgresql
dex_postgres_chart_version: ""  # Required if explicitly managing Bitnami PostgreSQL.
dex_postgres_storage_size: 10Gi
dex_postgres_host: postgresql
dex_postgres_port: 5432
dex_postgres_database: dex
dex_postgres_user: dex
dex_postgres_password: ""
dex_postgres_admin_password: ""
dex_postgres_ssl_mode: disable

# Preserve legacy internal plaintext LDAP behavior. TLS is explicitly opt-in.
# Plaintext exposes bind/user passwords; restrict this traffic to trusted networks.
dex_ldap_host: ldap.example.com:389
dex_ldap_insecure_no_ssl: true
dex_ldap_start_tls: false
dex_ldap_bind_dn: cn=readonly,dc=example,dc=com
dex_ldap_bind_password: ""
dex_ldap_root_ca: ""
dex_ca_secret_name: ""
dex_ldap_connector_id: ldap
dex_ldap_connector_name: Account
dex_ldap_user_base_dn: ou=people,dc=example,dc=com
dex_ldap_user_filter: "(objectClass=inetOrgPerson)"
dex_ldap_id_attribute: uid
dex_ldap_name_attribute: cn
dex_ldap_group_base_dn: ou=groups,dc=example,dc=com
# groupOfUniqueNames stores full user DNs in uniqueMember.
dex_ldap_group_user_attribute: DN
dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"

# Optional legacy Matrix convenience client. Configure its ID/secret explicitly.
dex_matrix_client_enabled: false
dex_matrix_redirect_uris: []
# Full objects (id, name, secret or secretEnv, redirectURIs). Use Vault for secrets.
dex_static_clients: []
# Optional extra connectors; the eom.dev site uses its existing LDAP connector.
dex_additional_connectors: []
# Optional environment Secret for secretEnv and $ENV connector credentials.
dex_env_secret_name: ""
dex_extra_volumes: []
dex_extra_volume_mounts: []

# eom.dev artwork is opt-in via the deployment playbook.
dex_theme_enabled: false
dex_brand_name: Dex
dex_theme_configmap_name: dex-catppuccin