# Base Ory Hydra Helm values.
# DOMAIN_SUFFIX is replaced at apply time via sed.
# secret.enabled: false — we create the "hydra" K8s Secret via seed script.
# DSN is set in config (chart strips it from env, so must be in values).

hydra:
  automigration:
    enabled: true
  config:
    dsn: "postgresql://hydra:localdev@postgres-rw.data.svc.cluster.local:5432/hydra_db?sslmode=disable"
    urls:
      self:
        issuer: https://auth.DOMAIN_SUFFIX/
      consent: https://auth.DOMAIN_SUFFIX/consent
      login: https://auth.DOMAIN_SUFFIX/login
      logout: https://auth.DOMAIN_SUFFIX/logout
      error: https://auth.DOMAIN_SUFFIX/error

    serve:
      cookies:
        same_site_mode: Lax
      public:
        cors:
          enabled: true
          allowed_origins:
            - https://*.DOMAIN_SUFFIX

# Disable chart's secret generation — we create the "hydra" secret via seed script
# with keys: secretsSystem, secretsCookie, pairwise-salt.
secret:
  enabled: false

# Allow Maester to create/update OAuth2Client secrets in the lasuite namespace.
# 'hydra-maester' is the subchart alias — values flow down under this key.
hydra-maester:
  enabledNamespaces:
    - lasuite

deployment:
  resources:
    limits:
      memory: 64Mi
    requests:
      memory: 32Mi
      cpu: 25m