# Stalwart OIDC client — registered with Hydra for SSO login.
# Hydra Maester creates K8s Secret "oidc-stalwart" in the stalwart namespace
# with CLIENT_ID and CLIENT_SECRET keys.
# DOMAIN_SUFFIX is replaced by sed at deploy time.
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
  name: stalwart
  namespace: stalwart
spec:
  clientName: Mail
  grantTypes:
    - authorization_code
    - refresh_token
  responseTypes:
    - code
  scope: openid email profile
  redirectUris:
    - https://mail.DOMAIN_SUFFIX/authorize/code
  postLogoutRedirectUris:
    - https://mail.DOMAIN_SUFFIX
  tokenEndpointAuthMethod: client_secret_post
  secretName: oidc-stalwart
  skipConsent: true