---
# Passwords supplied in a Vault-encrypted inventory, never in this example.
dex_issuer: https://dex.eom.dev/
dex_hostname: dex.eom.dev
dex_postgres_manage: false
dex_postgres_host: postgresql
dex_postgres_database: dex
dex_postgres_user: dex
# Legacy credential names are still supported by defaults:
# dex_admin_password, openldap_readonly_password, matrix_dex_oidc_client_secret.

# Existing Secret in the Dex namespace. WWW_DEX_CLIENT_SECRET must match the
# www membership app's DEX_CLIENT_SECRET. DEX_LDAP_BIND_PASSWORD is the search
# account password; no real values go in this public file.
dex_env_secret_name: dex-client-secrets
dex_static_clients:
  - id: www-membership
    name: eom.dev Membership
    secretEnv: WWW_DEX_CLIENT_SECRET
    redirectURIs:
      - https://www.eom.dev/members/oidc/callback/

# One LDAP connector admits both legacy POSIX accounts and website accounts.
# Keep its ID and idAttr unchanged so existing OIDC subjects remain stable.
dex_ldap_connector_id: ldap
dex_ldap_id_attribute: uid
dex_ldap_user_base_dn: dc=eom,dc=dev
dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"