# Argo CD Helm Chart Values (k8s-ng cluster)

global:
  nodeSelector:
    homelab.hexor.cy/pool: core
    homelab.hexor.cy/exposure: external
  domain: ag.btwiusearch.net
  logging:
    format: text
    level: info

crds:
  install: true
  keep: true # Recommended to keep true so CRDs are not deleted on uninstall

configs:
  params:
    server.insecure: "true" # TLS is terminated by the ingress
  cm:
    create: true
    exec.enabled: true
    kustomize.buildOptions: --enable-helm
    application.instanceLabelKey: argocd.argoproj.io/instance
    # Local admin account, kept as a break-glass login next to SSO; the initial
    # password is generated by Argo CD into the argocd-initial-admin-secret secret.
    # Set to false once SSO is trusted.
    admin.enabled: true
    statusbadge.enabled: true
    timeout.reconciliation: 60s
    # Lets sync waves in an app of apps wait for child Applications to be Healthy.
    resource.customizations.health.argoproj.io_Application: |
      hs = {}
      hs.status = "Progressing"
      hs.message = ""
      if obj.status ~= nil then
        if obj.status.health ~= nil then
          hs.status = obj.status.health.status
          if obj.status.health.message ~= nil then
            hs.message = obj.status.health.message
          end
        end
      end
      return hs
    # SSO through Dex -> Keycloak. The client id/secret come from the oidc-creds
    # Secret (labelled app.kubernetes.io/part-of=argocd), created by hand until
    # Vaultwarden + External Secrets are the source.
    dex.config: |
      connectors:
      - type: oidc
        id: keycloak
        name: Keycloak
        config:
          issuer: https://auth.hexor.cy/auth/realms/hexor
          clientID: $oidc-creds:id
          clientSecret: $oidc-creds:secret
          insecureEnableGroups: true
          scopes:
            - openid
            - profile
            - email
            - offline_access
          getUserInfo: true
  rbac:
    create: true
    policy.default: ""
    policy.csv: |
      g, game-servers-managers, GameServersManagersRole
      # Role permissions
      p, GameServersManagersRole, applications, get, games/*, allow
      p, GameServersManagersRole, applications, update, games/*, allow
      p, GameServersManagersRole, applications, sync, games/*, allow
      p, GameServersManagersRole, applications, override, games/*, allow
      p, GameServersManagersRole, applications, action/*, games/*, allow
      p, GameServersManagersRole, exec, create, games/*, allow
      p, GameServersManagersRole, logs, get, games/*, allow
      p, GameServersManagersRole, applications, delete, games/*, deny

      # Admin policy
      g, argocd-admins, role:admin
  secret:
    createSecret: true

controller:
  replicas: 1

# Dex OIDC provider (Keycloak connector configured in configs.cm.dex.config)
dex:
  replicas: 1
  enabled: true

redis:
  enabled: true

redis-ha:
  enabled: false

server:
  replicas: 1
  ingress:
    enabled: false
  certificate:
    enabled: false
  certificateSecret:
    enabled: false

repoServer:
  replicas: 1
  livenessProbe:
    timeoutSeconds: 10
    periodSeconds: 60

applicationSet:
  enabled: true
  replicas: 1

notifications:
  enabled: true
  replicas: 1