apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: dex
  namespace: flux-system
spec:
  type: oci
  interval: 1h
  url: oci://registry.registry.svc.cluster.local:5000/vendor/charts/dex
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: dex-secrets
  namespace: flux-system
spec:
  interval: 30m
  dependsOn:
    - name: platform-namespaces
    - name: vault
    - name: vault-secrets-webhook
  releaseName: dex-secrets
  targetNamespace: dex
  install:
    createNamespace: true
    remediation:
      retries: -1
  chart:
    spec:
      chart: app-template
      version: 4.6.0
      sourceRef:
        kind: HelmRepository
        name: app-template
  values:
    rawResources:
      dex-secrets:
        apiVersion: v1
        kind: Secret
        forceRename: dex-secrets
        annotations:
          vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
          vault.security.banzaicloud.io/vault-role: default
          vault.security.banzaicloud.io/vault-path: kubernetes
        spec:
          stringData:
            # Keep Vault resolution on the Secret object. Inline vault: env values
            # make Dex depend on pod mutation, and that path breaks here because
            # the webhook cannot use the K3s image mirror config for registry lookups.
            ADMIN_PASSWORD_HASH: vault:secret/data/dex/auth#ADMIN_PASSWORD_HASH
            KHUEDOAN_PASSWORD_HASH: vault:secret/data/dex/auth#KHUEDOAN_PASSWORD_HASH
            ACTUALBUDGET_CLIENT_SECRET: vault:secret/data/actualbudget/auth#client_secret
            FORGEJO_CLIENT_SECRET: vault:secret/data/forgejo/oauth#secret
            TEMPORAL_CLIENT_SECRET: vault:secret/data/temporal/oauth#client_secret
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: dex
  namespace: flux-system
spec:
  interval: 3m
  dependsOn:
    - name: platform-namespaces
    - name: dex-secrets
  chart:
    spec:
      chart: dex
      version: 0.23.0
      sourceRef:
        kind: HelmRepository
        name: dex
  releaseName: dex
  targetNamespace: dex
  install:
    createNamespace: true
    remediation:
      retries: -1
  values:
    image:
      repository: registry.registry.svc.cluster.local/vendor/images/dexidp/dex
      tag: v2.43.1
    envFrom:
      - secretRef:
          name: dex-secrets
    config:
      issuer: https://dex.staging.khuedoan.com
      storage:
        type: kubernetes
        config:
          inCluster: true
      oauth2:
        passwordConnector: local
        skipApprovalScreen: true
      enablePasswordDB: true
      staticPasswords:
        - username: admin
          email: admin@cloudlab.khuedoan.com
          userID: "b34bd9d2-70ed-4ee1-8d22-6e4fc84f8d17"
          hashFromEnv: ADMIN_PASSWORD_HASH
        - username: khuedoan
          email: mail@khuedoan.com
          userID: "41dd7db5-4cb3-4856-a7f1-0d5168a10a12"
          hashFromEnv: KHUEDOAN_PASSWORD_HASH
      staticClients:
        - id: actualbudget
          name: Actual Budget
          redirectURIs:
            - "https://budget.staging.khuedoan.com/openid/callback"
          secretEnv: ACTUALBUDGET_CLIENT_SECRET
        - id: forgejo
          name: Forgejo
          redirectURIs:
            - "https://code.staging.khuedoan.com/user/oauth2/SSO/callback"
          secretEnv: FORGEJO_CLIENT_SECRET
        - id: temporal
          name: Temporal
          redirectURIs:
            - "https://temporal.staging.khuedoan.com/auth/sso/callback"
          secretEnv: TEMPORAL_CLIENT_SECRET
    podAnnotations:
      istio.io/dataplane-mode: ambient
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 256Mi
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: dex-config
  namespace: flux-system
spec:
  interval: 30m
  dependsOn:
    - name: platform-namespaces
    - name: istio-gateway
  releaseName: dex-config
  targetNamespace: dex
  install:
    createNamespace: true
    remediation:
      retries: -1
  chart:
    spec:
      chart: app-template
      version: 4.6.0
      sourceRef:
        kind: HelmRepository
        name: app-template
  values:
    rawResources:
      dex-route:
        apiVersion: gateway.networking.k8s.io/v1
        kind: HTTPRoute
        forceRename: dex
        spec:
          spec:
            parentRefs:
              - name: gateway
                namespace: istio-system
            hostnames:
              - dex.staging.khuedoan.com
            rules:
              - matches:
                  - path:
                      type: PathPrefix
                      value: /
                backendRefs:
                  - name: dex
                    port: 5556