66 lines
2.4 KiB
YAML
Executable File
66 lines
2.4 KiB
YAML
Executable File
---
|
|
dex_namespace: dex
|
|
dex_release_name: dex
|
|
dex_chart_version: "0.26.0"
|
|
dex_issuer: "https://{{ dex_hostname }}/"
|
|
dex_hostname: dex.example.com
|
|
dex_ingress_class: nginx
|
|
dex_cluster_issuer: letsencrypt-prod
|
|
dex_tls_secret_name: dex
|
|
dex_wait_timeout: 600s
|
|
dex_image_tag: "" # Empty uses the pinned chart's application version.
|
|
dex_image_pull_secrets: []
|
|
dex_resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
|
|
# Reuse the existing postgresql release/PVC. Never upgrade it implicitly.
|
|
dex_postgres_manage: false
|
|
dex_postgres_release_name: postgresql
|
|
dex_postgres_chart_version: "" # Required if explicitly managing Bitnami PostgreSQL.
|
|
dex_postgres_storage_size: 10Gi
|
|
dex_postgres_host: postgresql
|
|
dex_postgres_port: 5432
|
|
dex_postgres_database: dex
|
|
dex_postgres_user: dex
|
|
dex_postgres_password: ""
|
|
dex_postgres_admin_password: ""
|
|
dex_postgres_ssl_mode: disable
|
|
|
|
# Preserve legacy internal plaintext LDAP behavior. TLS is explicitly opt-in.
|
|
# Plaintext exposes bind/user passwords; restrict this traffic to trusted networks.
|
|
dex_ldap_host: ldap.example.com:389
|
|
dex_ldap_insecure_no_ssl: true
|
|
dex_ldap_start_tls: false
|
|
dex_ldap_bind_dn: cn=readonly,dc=example,dc=com
|
|
dex_ldap_bind_password: ""
|
|
dex_ldap_root_ca: ""
|
|
dex_ca_secret_name: ""
|
|
dex_ldap_connector_id: ldap
|
|
dex_ldap_connector_name: Account
|
|
dex_ldap_user_base_dn: ou=people,dc=example,dc=com
|
|
dex_ldap_user_filter: "(objectClass=inetOrgPerson)"
|
|
dex_ldap_id_attribute: uid
|
|
dex_ldap_name_attribute: cn
|
|
dex_ldap_group_base_dn: ou=groups,dc=example,dc=com
|
|
# groupOfUniqueNames stores full user DNs in uniqueMember.
|
|
dex_ldap_group_user_attribute: DN
|
|
dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
|
|
|
|
# Optional legacy Matrix convenience client. Configure its ID/secret explicitly.
|
|
dex_matrix_client_enabled: false
|
|
dex_matrix_redirect_uris: []
|
|
# Full objects (id, name, secret or secretEnv, redirectURIs). Use Vault for secrets.
|
|
dex_static_clients: []
|
|
# Optional extra connectors; the eom.dev site uses its existing LDAP connector.
|
|
dex_additional_connectors: []
|
|
# Optional environment Secret for secretEnv and $ENV connector credentials.
|
|
dex_env_secret_name: ""
|
|
dex_extra_volumes: []
|
|
dex_extra_volume_mounts: []
|
|
|
|
# eom.dev artwork is opt-in via the deployment playbook.
|
|
dex_theme_enabled: false
|
|
dex_brand_name: Dex
|
|
dex_theme_configmap_name: dex-catppuccin
|