# Base Ory Hydra Helm values.
# DOMAIN_SUFFIX is replaced by overlay patches.
# DSN and system secrets come from the overlay-specific Secret.

hydra:
  config:
    dsn: "postgresql://hydra:$(HYDRA_DB_PASSWORD)@postgres-rw.data.svc.cluster.local:5432/hydra_db"

    urls:
      self:
        issuer: https://auth.DOMAIN_SUFFIX/
      consent: https://auth.DOMAIN_SUFFIX/consent
      login: https://auth.DOMAIN_SUFFIX/login
      logout: https://auth.DOMAIN_SUFFIX/logout
      error: https://auth.DOMAIN_SUFFIX/error

    secrets:
      system:
        - $(HYDRA_SYSTEM_SECRET)
      cookie:
        - $(HYDRA_COOKIE_SECRET)

    oidc:
      subject_identifiers:
        supported_types:
          - public
        pairwise:
          salt: $(HYDRA_PAIRWISE_SALT)

    serve:
      cookies:
        same_site_mode: Lax
      public:
        cors:
          enabled: true
          allowed_origins:
            - https://*.DOMAIN_SUFFIX

deployment:
  resources:
    limits:
      memory: 64Mi
    requests:
      memory: 32Mi
      cpu: 25m