replicaCount: 1
image:
  tag: {{ dex_image_tag | to_json }}
imagePullSecrets: {{ dex_image_pull_secrets | to_json }}
rbac:
  create: false
resources: {{ dex_resources | to_json }}
securityContext:
  runAsNonRoot: false
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: [ALL]
podAnnotations:
  theme/revision: {{ (lookup('ansible.builtin.file', role_path ~ '/files/styles.css') ~ lookup('ansible.builtin.file', role_path ~ '/files/logo.svg') ~ (dex_theme_enabled | string) ~ dex_env_secret_name ~ dex_ca_secret_name) | hash('sha256') | to_json }}
{% if dex_env_secret_name %}
envFrom:
  - secretRef:
      name: {{ dex_env_secret_name | to_json }}
{% endif %}
config:
  issuer: {{ dex_issuer | to_json }}
  logger:
    level: info
    format: json
{% if dex_theme_enabled %}
  frontend:
    issuer: {{ dex_brand_name | to_json }}
    dir: /srv/dex/web
    theme: light
    logoURL: theme/logo.svg
{% endif %}
  storage:
    type: postgres
    config:
      host: {{ dex_postgres_host | to_json }}
      port: {{ dex_postgres_port }}
      database: {{ dex_postgres_database | to_json }}
      user: {{ dex_postgres_user | to_json }}
      password: {{ dex_postgres_password | to_json }}
      ssl:
        mode: {{ dex_postgres_ssl_mode | to_json }}
  staticClients:{% if not dex_matrix_client_enabled and not dex_static_clients %} []{% endif %}

{% if dex_matrix_client_enabled %}
    - id: {{ matrix_dex_oidc_client_id | to_json }}
      name: Matrix Auth Service
      secret: {{ matrix_dex_oidc_client_secret | to_json }}
      redirectURIs: {{ dex_matrix_redirect_uris | to_json }}
{% endif %}
{% for client in dex_static_clients %}
    - {{ client | to_json }}
{% endfor %}
  connectors:
    - type: ldap
      id: {{ dex_ldap_connector_id | to_json }}
      name: {{ dex_ldap_connector_name | to_json }}
      config:
        host: {{ dex_ldap_host | to_json }}
        insecureNoSSL: {{ dex_ldap_insecure_no_ssl | bool | to_json }}
        startTLS: {{ dex_ldap_start_tls | bool | to_json }}
        insecureSkipVerify: false
{% if dex_ldap_root_ca %}
        rootCA: {{ dex_ldap_root_ca | to_json }}
{% endif %}
        bindDN: {{ dex_ldap_bind_dn | to_json }}
        bindPW: {{ dex_ldap_bind_password | to_json }}
        userSearch:
          baseDN: {{ dex_ldap_user_base_dn | to_json }}
          filter: {{ dex_ldap_user_filter | to_json }}
          username: uid
          idAttr: {{ dex_ldap_id_attribute | to_json }}
          emailAttr: mail
          nameAttr: {{ dex_ldap_name_attribute | to_json }}
          preferredUsernameAttr: uid
        groupSearch:
          baseDN: {{ dex_ldap_group_base_dn | to_json }}
          filter: {{ dex_ldap_group_filter | to_json }}
          userMatchers:
            - userAttr: {{ dex_ldap_group_user_attribute | to_json }}
              groupAttr: uniqueMember
          nameAttr: cn
{% for connector in dex_additional_connectors %}
    - {{ connector | to_json }}
{% endfor %}
volumes:
  - name: dex-tmp
    emptyDir:
      medium: Memory
      sizeLimit: 16Mi

{% if dex_theme_enabled %}
  - name: theme
    configMap:
      name: {{ dex_theme_configmap_name }}
{% endif %}
{% if dex_ca_secret_name %}
  - name: ca
    secret:
      secretName: {{ dex_ca_secret_name }}
{% endif %}
{% for volume in dex_extra_volumes %}
  - {{ volume | to_json }}
{% endfor %}
volumeMounts:
  - name: dex-tmp
    mountPath: /tmp

{% if dex_theme_enabled %}
  - name: theme
    mountPath: /srv/dex/web/themes/light/styles.css
    subPath: styles.css
    readOnly: true
  - name: theme
    mountPath: /srv/dex/web/themes/light/logo.svg
    subPath: logo.svg
    readOnly: true
{% endif %}
{% if dex_ca_secret_name %}
  - name: ca
    mountPath: /etc/dex-ca
    readOnly: true
{% endif %}
{% for mount in dex_extra_volume_mounts %}
  - {{ mount | to_json }}
{% endfor %}
ingress:
  enabled: true
  className: {{ dex_ingress_class | to_json }}
  annotations:
    cert-manager.io/cluster-issuer: {{ dex_cluster_issuer | to_json }}
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/enable-access-log: "false"
  hosts:
    - host: {{ dex_hostname }}
      paths:
        - path: /
          pathType: Prefix
  tls:
    - hosts: [{{ dex_hostname }}]
      secretName: {{ dex_tls_secret_name }}