Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-05-13 14:21:50 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2026-05-13 14:21:50 +00:00
20 changed files with 430 additions and 1001 deletions
@@ -1,10 +1,10 @@
-name: 'Keycloak Terraform'
+name: 'Terraform'
 on:
  push:
    branches: [ "main" ]
    paths:
-      - 'terraform/keycloak/**'
+      - 'terraform/authentik/**'
  pull_request:
 permissions:
@@ -13,6 +13,7 @@ permissions:
 jobs:
  terraform:
    name: 'Terraform'
    if: false
    runs-on: ubuntu-latest
    environment: production
@@ -29,25 +30,119 @@ jobs:
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
    - name: Setup kubeconfig
      run: |
        mkdir -p ~/.kube
        echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
        chmod 600 ~/.kube/config
    - name: Terraform Init
      env:
        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform init
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
    - name: Terraform Format
      env:
        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform fmt -check
      continue-on-error: true
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
    - name: Terraform Apply
      env:
-        TF_VAR_keycloak_client_secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
        TF_VAR_google_client_id: ${{ secrets.GOOGLE_CLIENT_ID }}
        TF_VAR_google_client_secret: ${{ secrets.GOOGLE_CLIENT_SECRET }}
      run: terraform apply -input=false -auto-approve -parallelism=100
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
    - name: Generate Wiki Content  
      if: success()
      continue-on-error: true
      env:
        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: |
        echo "📋 Starting Wiki generation..."
        cd ./terraform/authentik
        # Get terraform output
        echo "🔍 Generating Terraform output..."
        terraform output -json applications_for_wiki > terraform-raw-output.json 2>&1
        # Process output to extract clean JSON
        echo "📤 Processing Terraform output..."
        python3 ../../.gitea/scripts/process-terraform-output.py terraform-raw-output.json terraform-output.json
        # Run wiki generation
        echo "📊 Running wiki generation script..."
        if python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json; then
          echo "✅ Wiki content generated successfully"
        else
          echo "⚠️ Wiki generation failed, retrying with debug..."
          python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json --debug || echo "⚠️ Wiki generation failed"
        fi
        # Check results
        if [ -f "Applications.md" ]; then
          echo "✅ Wiki file created: $(wc -l < Applications.md) lines"
        else
          echo "⚠️ Wiki content not generated"
          exit 0
        fi
      working-directory: ./
    - name: Upload Wiki to Gitea
      if: success()  
      continue-on-error: true
      run: |
        cd ./terraform/authentik
        # Set variables
        GITEA_URL="${{ secrets.GT_URL }}"
        GITEA_TOKEN="${{ secrets.GT_WIKI_TOKEN }}"
        GITEA_OWNER="${{ secrets.GT_OWNER }}"
        GITEA_REPO="${{ secrets.GT_REPO }}"
        # Debug variables (without exposing token)
        echo "🔍 Checking variables..."
        echo "GITEA_URL: ${GITEA_URL:-NOT SET}"
        echo "GITEA_OWNER: ${GITEA_OWNER:-NOT SET}"
        echo "GITEA_REPO: ${GITEA_REPO:-NOT SET}"
        echo "GITEA_TOKEN: $(if [ -n "$GITEA_TOKEN" ]; then echo "SET"; else echo "NOT SET"; fi)"
        # Check if file exists
        if [ ! -f "Applications.md" ]; then
          echo "⚠️ Applications.md not found, skipping wiki update"
          exit 0
        fi
        echo "📤 Uploading to Gitea Wiki..."
        # Encode content to base64
        CONTENT=$(base64 -w 0 Applications.md)
        # Check if wiki page exists
        WIKI_PAGE_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
          -H "Authorization: token $GITEA_TOKEN" \
          "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "000")
        if [ "$WIKI_PAGE_EXISTS" = "200" ]; then
          echo "📝 Updating existing wiki page..."
          curl -X PATCH \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{
              \"title\": \"Applications\",
              \"content_base64\": \"$CONTENT\",
              \"message\": \"Update applications list from CI/CD [$(date)]\"
            }" \
            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "⚠️ Wiki update failed"
        else
          echo "📄 Creating new wiki page..."
          curl -X POST \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{
              \"title\": \"Applications\", 
              \"content_base64\": \"$CONTENT\",
              \"message\": \"Create applications list from CI/CD [$(date)]\"
            }" \
            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/new" || echo "⚠️ Wiki creation failed"
        fi
        echo "✅ Wiki update process completed"
      working-directory: ./
@@ -1,46 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-player
  labels:
    app: furumi-dev-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-player
  template:
    metadata:
      labels:
        app: furumi-dev-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-player
          image: ultradesu/furumusic:latest
          imagePullPolicy: Always
          env:
            - name: FURU_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-dev-creds
                  key: PG_STRING
          ports:
          - containerPort: 8000
            name: http
          volumeMounts:
            - name: library
              mountPath: /media
            - name: inbox
              mountPath: /inbox
      volumes:
        - name: library
          hostPath:
            path: /k8s/furumi-dev/library-new
            type: DirectoryOrCreate
        - name: inbox
          hostPath:
            path: /k8s/furumi-dev/inbox-new
            type: DirectoryOrCreate
@@ -5,46 +5,46 @@ metadata:
  name: furumi-ng-creds
 spec:
  target:
-    name: furumi-dev-creds
+    name: furumi-ng-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
-       #OIDC_CLIENT_ID: |-
+        OIDC_CLIENT_ID: |-
-       #  {{ .client_id }}
+          {{ .client_id }}
-       #OIDC_CLIENT_SECRET: |-
+        OIDC_CLIENT_SECRET: |-
-       #  {{ .client_secret }}
+          {{ .client_secret }}
-       #OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
+        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
-       #OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
+        OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
-       #OIDC_SESSION_SECRET: |-
+        OIDC_SESSION_SECRET: |-
-       #  {{ .session_secret }}
+          {{ .session_secret }}
        PG_STRING: |-
-          postgresql://furumi_dev:{{ .pg_pass }}@psql.psql.svc/furumi_dev
+          postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
  data:
-  # - secretKey: client_id
+    - secretKey: client_id
-  #   sourceRef:
+      sourceRef:
-  #     storeRef:
+        storeRef:
-  #       name: vaultwarden-login
+          name: vaultwarden-login
-  #       kind: ClusterSecretStore
+          kind: ClusterSecretStore
-  #   remoteRef:
+      remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[0].value
+        property: fields[0].value
-  # - secretKey: client_secret
+    - secretKey: client_secret
-  #   sourceRef:
+      sourceRef:
-  #     storeRef:
+        storeRef:
-  #       name: vaultwarden-login
+          name: vaultwarden-login
-  #       kind: ClusterSecretStore
+          kind: ClusterSecretStore
-  #   remoteRef:
+      remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[1].value
+        property: fields[1].value
-  # - secretKey: session_secret
+    - secretKey: session_secret
-  #   sourceRef:
+      sourceRef:
-  #     storeRef:
+        storeRef:
-  #       name: vaultwarden-login
+          name: vaultwarden-login
-  #       kind: ClusterSecretStore
+          kind: ClusterSecretStore
-  #   remoteRef:
+      remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[2].value
+        property: fields[2].value
    - secretKey: pg_pass
      sourceRef:
        storeRef:
@@ -1,8 +1,17 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: admin-strip
 spec:
  stripPrefix:
    prefixes:
      - /admin
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: furumi-dev-tls-ingress
+  name: furumi-tls-ingress
  annotations:
    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
@@ -13,15 +22,45 @@ spec:
    - host: music-dev.hexor.cy
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: furumi-dev-web-player
                port:
                  number: 8080
          - path: /
            pathType: Prefix
            backend:
              service:
-                name: furumi-dev-player
+                name: furumi-dev-node-player
                port:
-                  number: 8000
+                  number: 3001
  tls:
-    - secretName: furumi-dev-tls
+    - secretName: furumi-tls
      hosts:
-        - music-dev.hexor.cy
+        - '*.hexor.cy'
-
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: furumi-dev-admin-ingress
  annotations:
    ingressClassName: traefik
    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
 spec:
  rules:
    - host: music-dev.hexor.cy
      http:
        paths:
          - path: /admin
            pathType: Prefix
            backend:
              service:
                name: furumi-dev-metadata-agent
                port:
                  number: 8090
  tls:
    - secretName: furumi-tls
      hosts:
        - '*.hexor.cy'
@@ -6,4 +6,6 @@ resources:
  - service.yaml
  - external-secrets.yaml
  - ingress.yaml
-  - deployment.yaml
+  - web-player.yaml
  - node-player.yaml
  - metadata-agent.yaml
@@ -0,0 +1,59 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-metadata-agent
  labels:
    app: furumi-dev-metadata-agent
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-metadata-agent
  template:
    metadata:
      labels:
        app: furumi-dev-metadata-agent
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-metadata-agent
          image: ultradesu/furumi-metadata-agent:dev
          imagePullPolicy: Always
          env:
            - name: FURUMI_AGENT_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_AGENT_INBOX_DIR
              value: "/inbox"
            - name: FURUMI_AGENT_STORAGE_DIR
              value: "/media"
            - name: FURUMI_AGENT_OLLAMA_URL
              value: "http://100.120.76.49:1234"
            - name: FURUMI_AGENT_OLLAMA_MODEL
              value: "qwen2.5-32b-instruct"
            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
              value: "10"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: admin-ui
              containerPort: 8090
              protocol: TCP
          volumeMounts:
            - name: library
              mountPath: /media
            - name: inbox
              mountPath: /inbox
      volumes:
        - name: library
          hostPath:
            path: /k8s/furumi-dev/library
            type: DirectoryOrCreate
        - name: inbox
          hostPath:
            path: /k8s/furumi-dev/inbox
            type: DirectoryOrCreate
@@ -0,0 +1,53 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-node-player
  labels:
    app: furumi-dev-node-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-node-player
  template:
    metadata:
      labels:
        app: furumi-dev-node-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-node-player
          image: ultradesu/furumi-node-player:dev
          imagePullPolicy: Always
          env:
            - name: PORT
              value: "3001"
            - name: BASE_URL
              value: "https://music-dev.hexor.cy"
            - name: FRONTEND_ORIGIN
              value: "https://music-dev.hexor.cy"
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: OIDC_ISSUER_BASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_ISSUER_URL
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_ID
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_SECRET
          ports:
            - name: http
              containerPort: 3001
              protocol: TCP
@@ -2,15 +2,47 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: furumi-dev-player
+  name: furumi-dev-metadata-agent
  labels:
-    app: furumi-dev-player
+    app: furumi-dev-metadata-agent
 spec:
  type: ClusterIP
  selector:
-    app: furumi-dev-player
+    app: furumi-dev-metadata-agent
  ports:
    - name: admin-ui
      protocol: TCP
      port: 8090
      targetPort: 8090
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-dev-web-player
  labels:
    app: furumi-dev-web-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-dev-web-player
  ports:
    - name: http
      protocol: TCP
-      port: 3000
+      port: 8080
-      targetPort: 3000
+      targetPort: 8080
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-dev-node-player
  labels:
    app: furumi-dev-node-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-dev-node-player
  ports:
    - name: http
      protocol: TCP
      port: 3001
      targetPort: 3001
@@ -0,0 +1,69 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-web-player
  labels:
    app: furumi-dev-web-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-web-player
  template:
    metadata:
      labels:
        app: furumi-dev-web-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-web-player
          image: ultradesu/furumi-web-player:dev
          imagePullPolicy: Always
          env:
            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_ID
            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_SECRET
            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_ISSUER_URL
            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_REDIRECT_URL
            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: FURUMI_PLAYER_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_PLAYER_STORAGE_DIR
              value: "/media"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: music
              mountPath: /media
      volumes:
        - name: music
          hostPath:
            path: /k8s/furumi-dev/library
            type: DirectoryOrCreate
@@ -1,5 +1,5 @@
 ---
-image: &image 'pasarguard/panel:v4.0.2'
+image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -6,8 +6,6 @@ metadata:
    app: web-petting
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: web-petting
@@ -18,14 +16,13 @@ spec:
    spec:
      nodeSelector:
        kubernetes.io/os: linux
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: web-petting-data
      containers:
      - name: web-petting
-        image: ultradesu/web-petting:latest
+        image: ultradesu/web-petting:v0.1.6
        imagePullPolicy: Always
        args:
 #         - "tail"
@@ -1,366 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: keycloak-hacker-theme
  namespace: keycloak
 data:
  theme.properties: |
    parent=keycloak.v2
    import=common/keycloak
    styles=css/hacker.css
  hacker.css: |
    /* ============================================================
       HEXOR — Hacker Terminal Theme for Keycloak
       ============================================================ */
    @import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
    :root {
      --hk-bg: #0a0a0a;
      --hk-panel: #0d0d0d;
      --hk-border: #00ff4180;
      --hk-green: #00ff41;
      --hk-green-dim: #00cc33;
      --hk-green-glow: rgba(0, 255, 65, 0.15);
      --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
      --hk-cyan: #00e5ff;
      --hk-red: #ff3333;
      --hk-text: #b0ffb0;
      --hk-text-dim: #5a8a5a;
      --hk-input-bg: #050505;
      --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
    }
    /* -- Force dark always --------------------------------------------------- */
    html.login-pf,
    html.login-pf.pf-v5-theme-dark {
      color-scheme: dark;
    }
    /* -- Background: scanlines + CRT ---------------------------------------- */
    body#keycloak-bg {
      font-family: var(--hk-font) !important;
      background: var(--hk-bg) !important;
      color: var(--hk-text) !important;
      min-height: 100vh;
      position: relative;
    }
    body#keycloak-bg::before {
      content: '';
      position: fixed;
      inset: 0;
      background: repeating-linear-gradient(
        0deg,
        transparent,
        transparent 2px,
        rgba(0, 255, 65, 0.03) 2px,
        rgba(0, 255, 65, 0.03) 4px
      );
      pointer-events: none;
      z-index: 9999;
    }
    /* -- Login container ----------------------------------------------------- */
    .pf-v5-c-login {
      background: transparent !important;
    }
    .pf-v5-c-login__container {
      max-width: 480px !important;
    }
    /* -- Header / Brand ------------------------------------------------------ */
    #kc-header-wrapper {
      font-family: var(--hk-font) !important;
      color: var(--hk-green) !important;
      text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
      font-size: 1.5rem !important;
      letter-spacing: 0.15em;
      text-transform: uppercase;
    }
    #kc-header-wrapper .kc-logo-text span::before {
      content: '> ';
      opacity: 0.6;
    }
    /* -- Main card ----------------------------------------------------------- */
    .pf-v5-c-login__main {
      background: var(--hk-panel) !important;
      border: 1px solid var(--hk-border) !important;
      border-radius: 0 !important;
      box-shadow:
        0 0 15px var(--hk-green-glow),
        inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
    }
    /* -- Title --------------------------------------------------------------- */
    h1#kc-page-title,
    .pf-v5-c-title {
      font-family: var(--hk-font) !important;
      color: var(--hk-green) !important;
      text-shadow: 0 0 8px var(--hk-green-glow);
      font-weight: 600 !important;
      font-size: 1.25rem !important;
      letter-spacing: 0.05em;
    }
    /* -- Labels -------------------------------------------------------------- */
    .pf-v5-c-form__label-text {
      font-family: var(--hk-font) !important;
      color: var(--hk-green-dim) !important;
      font-size: 0.85rem !important;
      text-transform: uppercase;
      letter-spacing: 0.08em;
    }
    /* -- Input fields -------------------------------------------------------- */
    .pf-v5-c-form-control {
      background-color: var(--hk-input-bg) !important;
      border: 1px solid var(--hk-border) !important;
      border-radius: 0 !important;
      color: var(--hk-green) !important;
      font-family: var(--hk-font) !important;
      font-size: 0.9rem !important;
      caret-color: var(--hk-green);
      transition: border-color 0.2s, box-shadow 0.2s;
    }
    .pf-v5-c-form-control:focus-within,
    .pf-v5-c-form-control:focus {
      border-color: var(--hk-green) !important;
      box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
      outline: none !important;
    }
    .pf-v5-c-form-control input {
      color: var(--hk-green) !important;
      font-family: var(--hk-font) !important;
    }
    .pf-v5-c-form-control input::placeholder {
      color: var(--hk-text-dim) !important;
    }
    /* -- Primary button (Sign In) -------------------------------------------- */
    .pf-v5-c-button.pf-m-primary {
      background: transparent !important;
      border: 1px solid var(--hk-green) !important;
      border-radius: 0 !important;
      color: var(--hk-green) !important;
      font-family: var(--hk-font) !important;
      font-weight: 600 !important;
      text-transform: uppercase;
      letter-spacing: 0.12em;
      font-size: 0.9rem !important;
      transition: all 0.2s;
      position: relative;
      overflow: hidden;
    }
    .pf-v5-c-button.pf-m-primary:hover {
      background: var(--hk-green-glow) !important;
      box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
      color: #fff !important;
      text-shadow: 0 0 5px var(--hk-green);
    }
    /* -- Secondary button (Try Another Way, Passkey) ------------------------- */
    .pf-v5-c-button.pf-m-secondary {
      background: transparent !important;
      border: 1px solid var(--hk-cyan) !important;
      border-radius: 0 !important;
      color: var(--hk-cyan) !important;
      font-family: var(--hk-font) !important;
      text-transform: uppercase;
      letter-spacing: 0.1em;
      font-size: 0.85rem !important;
      transition: all 0.2s;
    }
    .pf-v5-c-button.pf-m-secondary:hover {
      background: rgba(0, 229, 255, 0.1) !important;
      box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
      color: #fff !important;
    }
    /* -- Passkey authenticate button ----------------------------------------- */
    #authenticateWebAuthnButton {
      background: transparent !important;
      border: 1px solid var(--hk-cyan) !important;
      border-radius: 0 !important;
      color: var(--hk-cyan) !important;
      font-family: var(--hk-font) !important;
      text-transform: uppercase;
      letter-spacing: 0.1em;
      font-size: 0.85rem !important;
      padding: 0.75rem 1rem;
      display: block;
      width: 100%;
      text-align: center;
      text-decoration: none;
      transition: all 0.2s;
      margin-top: 1rem;
    }
    #authenticateWebAuthnButton::before {
      content: '\f084  ';
      font-family: 'Font Awesome 6 Free', 'FontAwesome';
      font-weight: 900;
    }
    #authenticateWebAuthnButton:hover {
      background: rgba(0, 229, 255, 0.1) !important;
      box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
      color: #fff !important;
      text-shadow: 0 0 5px var(--hk-cyan);
    }
    /* -- Show password button ------------------------------------------------ */
    .pf-v5-c-button.pf-m-control {
      background: var(--hk-input-bg) !important;
      border: 1px solid var(--hk-border) !important;
      border-left: none !important;
      border-radius: 0 !important;
      color: var(--hk-text-dim) !important;
    }
    .pf-v5-c-button.pf-m-control:hover {
      color: var(--hk-green) !important;
    }
    /* -- Social providers (Google, etc) -------------------------------------- */
    .pf-v5-c-login__main-footer {
      border-top: 1px solid var(--hk-border) !important;
    }
    .kc-social-section .pf-v5-c-button.pf-m-secondary {
      border-color: var(--hk-text-dim) !important;
      color: var(--hk-text) !important;
    }
    .kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
      border-color: var(--hk-green) !important;
      color: var(--hk-green) !important;
      box-shadow: 0 0 10px var(--hk-green-glow) !important;
    }
    /* -- Try another way link ------------------------------------------------ */
    #try-another-way {
      color: var(--hk-cyan) !important;
      text-decoration: none !important;
      font-family: var(--hk-font) !important;
    }
    #try-another-way:hover {
      text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
    }
    /* -- Links --------------------------------------------------------------- */
    a {
      color: var(--hk-cyan) !important;
      text-decoration: none;
      transition: text-shadow 0.2s;
    }
    a:hover {
      text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
    }
    /* -- Alerts / messages --------------------------------------------------- */
    .pf-v5-c-alert {
      background: rgba(0, 255, 65, 0.05) !important;
      border: 1px solid var(--hk-border) !important;
      border-radius: 0 !important;
      font-family: var(--hk-font) !important;
    }
    .pf-v5-c-alert.pf-m-danger {
      border-color: var(--hk-red) !important;
      background: rgba(255, 51, 51, 0.05) !important;
    }
    .pf-v5-c-alert__title {
      color: var(--hk-text) !important;
      font-family: var(--hk-font) !important;
    }
    /* -- Checkbox (Remember me) ---------------------------------------------- */
    .pf-v5-c-check__label {
      color: var(--hk-text-dim) !important;
      font-family: var(--hk-font) !important;
      font-size: 0.8rem !important;
    }
    /* -- Helper text (Forgot password, etc.) --------------------------------- */
    .pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
      color: var(--hk-cyan) !important;
      font-family: var(--hk-font) !important;
      font-size: 0.8rem !important;
    }
    /* -- Select auth list (Try another way options) -------------------------- */
    .select-auth-container {
      background: var(--hk-panel) !important;
      font-family: var(--hk-font) !important;
    }
    .pf-v5-c-data-list__item {
      border-color: var(--hk-border) !important;
      background: transparent !important;
    }
    .pf-v5-c-data-list__item:hover {
      background: var(--hk-green-glow) !important;
    }
    .select-auth-box-headline {
      color: var(--hk-green) !important;
    }
    .select-auth-box-desc {
      color: var(--hk-text-dim) !important;
    }
    /* -- Footer -------------------------------------------------------------- */
    .pf-v5-c-login__main-footer-band {
      background: transparent !important;
      border-top: 1px solid var(--hk-border) !important;
    }
    /* -- Language selector --------------------------------------------------- */
    select#login-select-toggle {
      background: var(--hk-input-bg) !important;
      color: var(--hk-green) !important;
      border-color: var(--hk-border) !important;
      font-family: var(--hk-font) !important;
    }
    /* -- Blinking cursor animation for header -------------------------------- */
    @keyframes blink {
      0%, 100% { opacity: 1; }
      50% { opacity: 0; }
    }
    #kc-header-wrapper::after {
      content: '_';
      animation: blink 1s step-end infinite;
      color: var(--hk-green);
    }
    /* -- Subtle CRT flicker ------------------------------------------------- */
    @keyframes flicker {
      0% { opacity: 0.97; }
      5% { opacity: 0.95; }
      10% { opacity: 0.98; }
      15% { opacity: 0.96; }
      20% { opacity: 0.99; }
      100% { opacity: 0.98; }
    }
    .pf-v5-c-login__main {
      animation: flicker 4s infinite;
    }
@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
  - app.yaml
  - external-secrets.yaml
  - hacker-theme-configmap.yaml
 helmCharts:
  - name: keycloakx
@@ -1,353 +0,0 @@
 /* ============================================================
   HEXOR — Hacker Terminal Theme for Keycloak
   ============================================================ */
@import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
 :root {
  --hk-bg: #0a0a0a;
  --hk-panel: #0d0d0d;
  --hk-border: #00ff4180;
  --hk-green: #00ff41;
  --hk-green-dim: #00cc33;
  --hk-green-glow: rgba(0, 255, 65, 0.15);
  --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
  --hk-cyan: #00e5ff;
  --hk-red: #ff3333;
  --hk-text: #b0ffb0;
  --hk-text-dim: #5a8a5a;
  --hk-input-bg: #050505;
  --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
 }
 /* -- Force dark always --------------------------------------------------- */
 html.login-pf,
 html.login-pf.pf-v5-theme-dark {
  color-scheme: dark;
 }
 /* -- Background: scanlines + CRT ---------------------------------------- */
 body#keycloak-bg {
  font-family: var(--hk-font) !important;
  background: var(--hk-bg) !important;
  color: var(--hk-text) !important;
  min-height: 100vh;
  position: relative;
 }
 body#keycloak-bg::before {
  content: '';
  position: fixed;
  inset: 0;
  background: repeating-linear-gradient(
    0deg,
    transparent,
    transparent 2px,
    rgba(0, 255, 65, 0.03) 2px,
    rgba(0, 255, 65, 0.03) 4px
  );
  pointer-events: none;
  z-index: 9999;
 }
 /* -- Login container ----------------------------------------------------- */
 .pf-v5-c-login {
  background: transparent !important;
 }
 .pf-v5-c-login__container {
  max-width: 480px !important;
 }
 /* -- Header / Brand ------------------------------------------------------ */
 #kc-header-wrapper {
  font-family: var(--hk-font) !important;
  color: var(--hk-green) !important;
  text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
  font-size: 1.5rem !important;
  letter-spacing: 0.15em;
  text-transform: uppercase;
 }
 #kc-header-wrapper .kc-logo-text span::before {
  content: '> ';
  opacity: 0.6;
 }
 /* -- Main card ----------------------------------------------------------- */
 .pf-v5-c-login__main {
  background: var(--hk-panel) !important;
  border: 1px solid var(--hk-border) !important;
  border-radius: 0 !important;
  box-shadow:
    0 0 15px var(--hk-green-glow),
    inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
 }
 /* -- Title --------------------------------------------------------------- */
 h1#kc-page-title,
 .pf-v5-c-title {
  font-family: var(--hk-font) !important;
  color: var(--hk-green) !important;
  text-shadow: 0 0 8px var(--hk-green-glow);
  font-weight: 600 !important;
  font-size: 1.25rem !important;
  letter-spacing: 0.05em;
 }
 /* -- Labels -------------------------------------------------------------- */
 .pf-v5-c-form__label-text {
  font-family: var(--hk-font) !important;
  color: var(--hk-green-dim) !important;
  font-size: 0.85rem !important;
  text-transform: uppercase;
  letter-spacing: 0.08em;
 }
 /* -- Input fields -------------------------------------------------------- */
 .pf-v5-c-form-control {
  background-color: var(--hk-input-bg) !important;
  border: 1px solid var(--hk-border) !important;
  border-radius: 0 !important;
  color: var(--hk-green) !important;
  font-family: var(--hk-font) !important;
  font-size: 0.9rem !important;
  caret-color: var(--hk-green);
  transition: border-color 0.2s, box-shadow 0.2s;
 }
 .pf-v5-c-form-control:focus-within,
 .pf-v5-c-form-control:focus {
  border-color: var(--hk-green) !important;
  box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
  outline: none !important;
 }
 .pf-v5-c-form-control input {
  color: var(--hk-green) !important;
  font-family: var(--hk-font) !important;
 }
 .pf-v5-c-form-control input::placeholder {
  color: var(--hk-text-dim) !important;
 }
 /* -- Primary button (Sign In) -------------------------------------------- */
 .pf-v5-c-button.pf-m-primary {
  background: transparent !important;
  border: 1px solid var(--hk-green) !important;
  border-radius: 0 !important;
  color: var(--hk-green) !important;
  font-family: var(--hk-font) !important;
  font-weight: 600 !important;
  text-transform: uppercase;
  letter-spacing: 0.12em;
  font-size: 0.9rem !important;
  transition: all 0.2s;
  position: relative;
  overflow: hidden;
 }
 .pf-v5-c-button.pf-m-primary:hover {
  background: var(--hk-green-glow) !important;
  box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
  color: #fff !important;
  text-shadow: 0 0 5px var(--hk-green);
 }
 /* -- Secondary button (Try Another Way, Passkey) ------------------------- */
 .pf-v5-c-button.pf-m-secondary {
  background: transparent !important;
  border: 1px solid var(--hk-cyan) !important;
  border-radius: 0 !important;
  color: var(--hk-cyan) !important;
  font-family: var(--hk-font) !important;
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-size: 0.85rem !important;
  transition: all 0.2s;
 }
 .pf-v5-c-button.pf-m-secondary:hover {
  background: rgba(0, 229, 255, 0.1) !important;
  box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
  color: #fff !important;
 }
 /* -- Passkey authenticate button ----------------------------------------- */
 #authenticateWebAuthnButton {
  background: transparent !important;
  border: 1px solid var(--hk-cyan) !important;
  border-radius: 0 !important;
  color: var(--hk-cyan) !important;
  font-family: var(--hk-font) !important;
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-size: 0.85rem !important;
  padding: 0.75rem 1rem;
  display: block;
  width: 100%;
  text-align: center;
  text-decoration: none;
  transition: all 0.2s;
  margin-top: 1rem;
 }
 #authenticateWebAuthnButton::before {
  content: '\f084  ';
  font-family: 'Font Awesome 6 Free', 'FontAwesome';
  font-weight: 900;
 }
 #authenticateWebAuthnButton:hover {
  background: rgba(0, 229, 255, 0.1) !important;
  box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
  color: #fff !important;
  text-shadow: 0 0 5px var(--hk-cyan);
 }
 /* -- Show password button ------------------------------------------------ */
 .pf-v5-c-button.pf-m-control {
  background: var(--hk-input-bg) !important;
  border: 1px solid var(--hk-border) !important;
  border-left: none !important;
  border-radius: 0 !important;
  color: var(--hk-text-dim) !important;
 }
 .pf-v5-c-button.pf-m-control:hover {
  color: var(--hk-green) !important;
 }
 /* -- Social providers (Google, etc) -------------------------------------- */
 .pf-v5-c-login__main-footer {
  border-top: 1px solid var(--hk-border) !important;
 }
 .kc-social-section .pf-v5-c-button.pf-m-secondary {
  border-color: var(--hk-text-dim) !important;
  color: var(--hk-text) !important;
 }
 .kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
  border-color: var(--hk-green) !important;
  color: var(--hk-green) !important;
  box-shadow: 0 0 10px var(--hk-green-glow) !important;
 }
 /* -- Try another way link ------------------------------------------------ */
 #try-another-way {
  color: var(--hk-cyan) !important;
  text-decoration: none !important;
  font-family: var(--hk-font) !important;
 }
 #try-another-way:hover {
  text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
 }
 /* -- Links --------------------------------------------------------------- */
 a {
  color: var(--hk-cyan) !important;
  text-decoration: none;
  transition: text-shadow 0.2s;
 }
 a:hover {
  text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
 }
 /* -- Alerts / messages --------------------------------------------------- */
 .pf-v5-c-alert {
  background: rgba(0, 255, 65, 0.05) !important;
  border: 1px solid var(--hk-border) !important;
  border-radius: 0 !important;
  font-family: var(--hk-font) !important;
 }
 .pf-v5-c-alert.pf-m-danger {
  border-color: var(--hk-red) !important;
  background: rgba(255, 51, 51, 0.05) !important;
 }
 .pf-v5-c-alert__title {
  color: var(--hk-text) !important;
  font-family: var(--hk-font) !important;
 }
 /* -- Checkbox (Remember me) ---------------------------------------------- */
 .pf-v5-c-check__label {
  color: var(--hk-text-dim) !important;
  font-family: var(--hk-font) !important;
  font-size: 0.8rem !important;
 }
 /* -- Helper text (Forgot password, etc.) --------------------------------- */
 .pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
  color: var(--hk-cyan) !important;
  font-family: var(--hk-font) !important;
  font-size: 0.8rem !important;
 }
 /* -- Select auth list (Try another way options) -------------------------- */
 .select-auth-container {
  background: var(--hk-panel) !important;
  font-family: var(--hk-font) !important;
 }
 .pf-v5-c-data-list__item {
  border-color: var(--hk-border) !important;
  background: transparent !important;
 }
 .pf-v5-c-data-list__item:hover {
  background: var(--hk-green-glow) !important;
 }
 .select-auth-box-headline {
  color: var(--hk-green) !important;
 }
 .select-auth-box-desc {
  color: var(--hk-text-dim) !important;
 }
 /* -- Footer -------------------------------------------------------------- */
 .pf-v5-c-login__main-footer-band {
  background: transparent !important;
  border-top: 1px solid var(--hk-border) !important;
 }
 /* -- Language selector --------------------------------------------------- */
 select#login-select-toggle {
  background: var(--hk-input-bg) !important;
  color: var(--hk-green) !important;
  border-color: var(--hk-border) !important;
  font-family: var(--hk-font) !important;
 }
 /* -- Blinking cursor animation for header -------------------------------- */
@keyframes blink {
  0%, 100% { opacity: 1; }
  50% { opacity: 0; }
 }
 #kc-header-wrapper::after {
  content: '_';
  animation: blink 1s step-end infinite;
  color: var(--hk-green);
 }
 /* -- Subtle CRT flicker ------------------------------------------------- */
@keyframes flicker {
  0% { opacity: 0.97; }
  5% { opacity: 0.95; }
  10% { opacity: 0.98; }
  15% { opacity: 0.96; }
  20% { opacity: 0.99; }
  100% { opacity: 0.98; }
 }
 .pf-v5-c-login__main {
  animation: flicker 4s infinite;
 }
@@ -1,4 +0,0 @@
 parent=keycloak.v2
 import=common/keycloak
 styles=css/hacker.css
@@ -21,19 +21,6 @@ extraEnv: |
  - name: JAVA_OPTS_APPEND
    value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
 extraVolumes: |
  - name: hacker-theme
    configMap:
      name: keycloak-hacker-theme
 extraVolumeMounts: |
  - name: hacker-theme
    mountPath: /opt/keycloak/themes/hacker/login/theme.properties
    subPath: theme.properties
  - name: hacker-theme
    mountPath: /opt/keycloak/themes/hacker/login/css/hacker.css
    subPath: hacker.css
 dbchecker:
  enabled: true
@@ -17,23 +17,20 @@ spec:
        PGADMIN_CONFIG_OAUTH2_CONFIG: |-
          [
            {
-                'OAUTH2_NAME': 'Keycloak',
+              'OAUTH2_NAME': 'Authentik',
-                'OAUTH2_DISPLAY_NAME': 'Keycloak',
+              'OAUTH2_DISPLAY_NAME': 'Authentik',
-                'OAUTH2_CLIENT_ID': '{{ .client_id }}',
+              'OAUTH2_CLIENT_ID': '{{ .client_id }}',
-                'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
+              'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
-                
+              'OAUTH2_TOKEN_URL': '{{ .pgadmin_url }}/application/o/token/',
-                'OAUTH2_TOKEN_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/token',
+              'OAUTH2_AUTHORIZATION_URL': '{{ .pgadmin_url }}/application/o/authorize/',
-                'OAUTH2_AUTHORIZATION_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/auth',
+              'OAUTH2_SERVER_METADATA_URL': '{{ .pgadmin_url }}/application/o/pgadmin/.well-known/openid-configuration',
-                'OAUTH2_SERVER_METADATA_URL': '{{ .keycloak_url }}/auth/realms/hexor/.well-known/openid-configuration',
+              'OAUTH2_API_BASE_URL': '{{ .pgadmin_url }}',
-                'OAUTH2_API_BASE_URL': '{{ .keycloak_url }}',
+              'OAUTH2_USERINFO_ENDPOINT': '{{ .pgadmin_url }}/application/o/userinfo/',
-                'OAUTH2_USERINFO_ENDPOINT': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/userinfo',
+              'OAUTH2_SCOPE': 'openid profile email',
-                
+              'OAUTH2_USERNAME_CLAIM': 'email',
-                'OAUTH2_SCOPE': 'openid profile email',
+              'OAUTH2_BUTTON_COLOR': '#000000',
-                'OAUTH2_USERNAME_CLAIM': 'email',
+              'OAUTH2_SSL_CERT_VERIFICATION': False,
-                'OAUTH2_BUTTON_COLOR': '#000000',
+              'OAUTH2_LOGOUT_URL': '{{ .pgadmin_url }}/application/o/pgadmin/end-session/'
                'OAUTH2_SSL_CERT_VERIFICATION': False,
                'OAUTH2_LOGOUT_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/logout',
            }
          ]
  data:
@@ -81,7 +78,7 @@ spec:
        metadataPolicy: None
        key: 832042b9-7edb-4f4c-9254-3c8884ba9733
        property: fields[1].value
-    - secretKey: keycloak_url
+    - secretKey: pgadmin_url
      sourceRef:
        storeRef:
          name: vaultwarden-login
@@ -6,7 +6,6 @@ provider "registry.terraform.io/hashicorp/kubernetes" {
  constraints = ">= 2.0.0"
  hashes = [
    "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
    "h1:iDIPyL9K9FXc8ievR5vRmXsgT1/I9Vq9CFDKm1Zo8bQ=",
    "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
    "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
    "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
@@ -27,7 +26,6 @@ provider "registry.terraform.io/keycloak/keycloak" {
  constraints = ">= 5.0.0"
  hashes = [
    "h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
    "h1:reFEBcuBZf2SVqDa1YIaNLuIW72uEVsOu5hHhQgfHi0=",
    "zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
    "zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
    "zh:34a9e2dfb06331dc6146491c4a0721001195c6a769cdc2d4546edb2acf2b39bd",
@@ -8,7 +8,7 @@ resource "keycloak_realm" "hexor" {
  display_name = "Hexor"
-  login_theme   = "keycloak.v2"
+  login_theme   = "keycloak"
  account_theme = "keycloak.v3"
  registration_allowed     = false
@@ -19,119 +19,6 @@ resource "keycloak_realm" "hexor" {
  duplicate_emails_allowed = false
  ssl_required = "external"
  web_authn_passwordless_policy {
    relying_party_entity_name         = "Hexor"
    relying_party_id                  = "hexor.cy"
    signature_algorithms              = ["ES256", "RS256"]
    user_verification_requirement     = "required"
    require_resident_key              = "Yes"
    attestation_conveyance_preference = "none"
  }
 }
 # =============================================================================
 # Passkey (WebAuthn Passwordless) — required action
 # =============================================================================
 resource "keycloak_required_action" "webauthn_register_passwordless" {
  realm_id       = keycloak_realm.hexor.id
  alias          = "webauthn-register-passwordless"
  name           = "Webauthn Register Passwordless"
  enabled        = true
  default_action = false
 }
 # =============================================================================
 # Browser flow with Passkey support
 # =============================================================================
 resource "keycloak_authentication_flow" "browser_with_passkey" {
  realm_id    = keycloak_realm.hexor.id
  alias       = "browser-with-passkey"
  description = "Browser flow with passkey/password alternatives"
  provider_id = "basic-flow"
 }
 # --- Cookie (re-use existing session) ---
 resource "keycloak_authentication_execution" "cookie" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
  authenticator     = "auth-cookie"
  requirement       = "ALTERNATIVE"
  priority          = 10
 }
 # --- Identity Provider Redirector ---
 resource "keycloak_authentication_execution" "idp_redirector" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
  authenticator     = "identity-provider-redirector"
  requirement       = "ALTERNATIVE"
  priority          = 20
 }
 # --- Passkey (WebAuthn Passwordless) ---
 resource "keycloak_authentication_execution" "passkey" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
  authenticator     = "webauthn-authenticator-passwordless"
  requirement       = "ALTERNATIVE"
  priority          = 30
 }
 # --- Username/Password + optional 2FA subflow ---
 resource "keycloak_authentication_subflow" "forms" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
  alias             = "browser-with-passkey-forms"
  provider_id       = "basic-flow"
  requirement       = "ALTERNATIVE"
  priority          = 40
 }
 resource "keycloak_authentication_execution" "username_password" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_subflow.forms.alias
  authenticator     = "auth-username-password-form"
  requirement       = "REQUIRED"
  priority          = 10
 }
 resource "keycloak_authentication_subflow" "conditional_2fa" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_subflow.forms.alias
  alias             = "browser-with-passkey-conditional-2fa"
  provider_id       = "basic-flow"
  requirement       = "CONDITIONAL"
  priority          = 20
 }
 resource "keycloak_authentication_execution" "condition_user_configured" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_subflow.conditional_2fa.alias
  authenticator     = "conditional-user-configured"
  requirement       = "REQUIRED"
  priority          = 10
 }
 resource "keycloak_authentication_execution" "otp_form" {
  realm_id          = keycloak_realm.hexor.id
  parent_flow_alias = keycloak_authentication_subflow.conditional_2fa.alias
  authenticator     = "auth-otp-form"
  requirement       = "ALTERNATIVE"
  priority          = 20
 }
 # --- Bind the new flow as the browser flow ---
 resource "keycloak_authentication_bindings" "browser" {
  realm_id     = keycloak_realm.hexor.id
  browser_flow = keycloak_authentication_flow.browser_with_passkey.alias
 }
 # =============================================================================
@@ -199,6 +86,7 @@ resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
  client_id = keycloak_openid_client.rsauth2_proxy.id
  default_scopes = [
    "openid",
    "profile",
    "email",
  ]
@@ -262,7 +150,7 @@ resource "keycloak_openid_client_default_scopes" "oauth2_app" {
  client_id = keycloak_openid_client.oauth2_app[each.key].id
  default_scopes = concat(
-    ["profile", "email"],
+    ["openid", "profile", "email"],
    each.value.extra_default_scopes
  )
 }
@@ -3,8 +3,6 @@ groups = [
  "hexor-guest",
  "game-servers-managers",
  "argocd-admins",
  "web-petting",
  "Furumusic-Admins"
 ]
 proxy_applications = {
@@ -25,30 +23,15 @@ oauth2_applications = {
    post_logout_redirect_uris = ["https://gt.hexor.cy/*"]
  }
  ArgoCD = {
-    redirect_uris             = ["https://ag.hexor.cy/api/dex/callback"]
+    redirect_uris             = ["https://ag.hexor.cy/auth/callback"]
    web_origins               = ["https://ag.hexor.cy"]
    post_logout_redirect_uris = ["https://ag.hexor.cy/*"]
    extra_optional_scopes     = ["offline_access"]
  }
  PGAdmin = {
    redirect_uris             = ["https://pg.hexor.cy/oauth2/authorize"]
    web_origins               = ["https://pg.hexor.cy"]
    post_logout_redirect_uris = ["https://pg.hexor.cy/*"]
  }
  Grafana = {
    redirect_uris             = ["https://gf.hexor.cy/login/generic_oauth"]
    web_origins               = ["https://gf.hexor.cy"]
    post_logout_redirect_uris = ["https://gf.hexor.cy/*"]
  }
  FuruMusic = {
    redirect_uris             = ["https://music.hexor.cy/auth/oidc/callback", "http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.103:3000/auth/oidc/callback"]
    web_origins               = ["https://music.hexor.cy", "http://127.0.0.1:3000", "http://10.0.5.103:3000"]
    post_logout_redirect_uris = ["https://music.hexor.cy/*", "http://127.0.0.1:3000/*", "http://10.0.5.103:3000/*"]
  }
  Web-Petting = {
    redirect_uris             = ["https://pet.hexor.cy/admin/oidc/callback", "https://xn--l1acako8eb.xn--p1ai/admin/oidc/callback", "https://мурняня.рф/admin/oidc/callback"]
    web_origins               = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
    post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
  }
 }