Sienna Meridian Satterwhite
5e36322a3b
- Add find user and find_db to postgres-cluster.yaml (11th database) - Add sunbeam-messages-imports and sunbeam-people buckets to SeaweedFS - Configure Hydra Maester with enabledNamespaces: [lasuite] so it can create and update OAuth2Client secrets in the lasuite namespace - Add find to Kratos allowed_return_urls - Add shared ConfigMaps: lasuite-postgres, lasuite-valkey, lasuite-s3, lasuite-oidc-provider — single source of truth for all app env vars - Add HydraOAuth2Client CRDs for all nine La Suite apps (docs, drive, meet, conversations, messages, people, find, gitea, hive); Maester will create oidc-<app> secrets with CLIENT_ID and CLIENT_SECRET
69 lines
3.1 KiB
YAML
69 lines
3.1 KiB
YAML
# Base Ory Kratos Helm values.
|
|
# DOMAIN_SUFFIX is replaced at apply time via sed.
|
|
# DSN is set in config (chart renders it into kratos-secrets Secret automatically).
|
|
|
|
kratos:
|
|
automigration:
|
|
enabled: true
|
|
config:
|
|
version: v0.13.0
|
|
dsn: "postgresql://kratos:localdev@postgres-rw.data.svc.cluster.local:5432/kratos_db?sslmode=disable"
|
|
|
|
selfservice:
|
|
default_browser_return_url: https://auth.DOMAIN_SUFFIX/
|
|
allowed_return_urls:
|
|
- https://auth.DOMAIN_SUFFIX/
|
|
- https://docs.DOMAIN_SUFFIX/
|
|
- https://meet.DOMAIN_SUFFIX/
|
|
- https://drive.DOMAIN_SUFFIX/
|
|
- https://mail.DOMAIN_SUFFIX/
|
|
- https://chat.DOMAIN_SUFFIX/
|
|
- https://people.DOMAIN_SUFFIX/
|
|
- https://src.DOMAIN_SUFFIX/
|
|
- https://find.DOMAIN_SUFFIX/
|
|
flows:
|
|
login:
|
|
ui_url: https://auth.DOMAIN_SUFFIX/login
|
|
registration:
|
|
ui_url: https://auth.DOMAIN_SUFFIX/registration
|
|
enabled: true
|
|
recovery:
|
|
ui_url: https://auth.DOMAIN_SUFFIX/recovery
|
|
settings:
|
|
ui_url: https://auth.DOMAIN_SUFFIX/settings
|
|
|
|
identity:
|
|
default_schema_id: default
|
|
schemas:
|
|
- id: default
|
|
url: base64://ewogICIkaWQiOiAiaHR0cHM6Ly9zY2hlbWFzLnN1bmJlYW0uc3R1ZGlvL2lkZW50aXR5Lmpzb24iLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAidGl0bGUiOiAiUGVyc29uIiwKICAicHJvcGVydGllcyI6IHsKICAgICJ0cmFpdHMiOiB7CiAgICAgICJ0eXBlIjogIm9iamVjdCIsCiAgICAgICJwcm9wZXJ0aWVzIjogewogICAgICAgICJlbWFpbCI6IHsKICAgICAgICAgICJ0eXBlIjogInN0cmluZyIsCiAgICAgICAgICAiZm9ybWF0IjogImVtYWlsIiwKICAgICAgICAgICJ0aXRsZSI6ICJFbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgInJlY292ZXJ5IjogewogICAgICAgICAgICAgICJ2aWEiOiAiZW1haWwiCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJ2ZXJpZmljYXRpb24iOiB7CiAgICAgICAgICAgICAgInZpYSI6ICJlbWFpbCIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0sCiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsgInR5cGUiOiAic3RyaW5nIiwgInRpdGxlIjogIkZpcnN0IG5hbWUiIH0sCiAgICAgICAgICAgICJsYXN0IjogeyAidHlwZSI6ICJzdHJpbmciLCAidGl0bGUiOiAiTGFzdCBuYW1lIiB9CiAgICAgICAgICB9CiAgICAgICAgfQogICAgICB9LAogICAgICAicmVxdWlyZWQiOiBbImVtYWlsIl0KICAgIH0KICB9Cn0K
|
|
|
|
courier:
|
|
smtp:
|
|
connection_uri: "smtp://postfix.lasuite.svc.cluster.local:25/?skip_ssl_verify=true"
|
|
from_address: no-reply@DOMAIN_SUFFIX
|
|
from_name: Sunbeam
|
|
|
|
serve:
|
|
public:
|
|
base_url: https://auth.DOMAIN_SUFFIX/kratos/
|
|
cors:
|
|
enabled: true
|
|
allowed_origins:
|
|
- https://*.DOMAIN_SUFFIX
|
|
admin:
|
|
base_url: http://kratos-admin.ory.svc.cluster.local:4434/
|
|
|
|
# Chart creates kratos-secrets from Helm values (dsn + generated random secrets).
|
|
secret:
|
|
enabled: true
|
|
nameOverride: kratos-secrets
|
|
|
|
deployment:
|
|
resources:
|
|
limits:
|
|
memory: 64Mi
|
|
requests:
|
|
memory: 32Mi
|
|
cpu: 25m
|