# Tuwunel OIDC client — registered with Hydra via hydra-maester.
# Hydra Maester creates K8s Secret "oidc-tuwunel" in the matrix namespace
# with CLIENT_ID and CLIENT_SECRET keys.
# redirectUri is patched post-apply by sunbeam CLI (requires client_id
# from the hydra-maester-generated secret).
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
  name: tuwunel
  namespace: matrix
spec:
  clientName: Matrix
  grantTypes:
    - authorization_code
    - refresh_token
  responseTypes:
    - code
  scope: openid email profile
  redirectUris: []
  tokenEndpointAuthMethod: client_secret_post
  secretName: oidc-tuwunel
  skipConsent: true