# values/argocd.values.yaml

global:
  domain: argocd.kube.huskypup.net

configs:
  cm:
    url: https://argocd.kube.huskypup.net
    oidc.config: |
      name: Authentik
      issuer: https://auth.kube.huskypup.net/application/o/argocd/
      clientID: $oidc.authentik.clientId
      clientSecret: $oidc.authentik.clientSecret
      requestedScopes:
        - openid
        - profile
        - email
        - groups
  
  rbac:
    policy.default: role:readonly
    scopes: '[groups, preferred_username]'
    policy.csv: |
      g, Authentik Admins, role:admin
      g, ArgoCD Admins, role:admin
      g, Scooby, role:admin

server:
  extraArgs:
    - --insecure  # TLS is terminated at Istio gateway

  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - auth.kube.huskypup.net
        - gitlab.kube.huskypup.net

  ingress:
    enabled: false

  env:
    - name: oidc.authentik.clientId
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-id
    - name: oidc.authentik.clientSecret
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-secret

dex:
  enabled: false  # using Authentik instead of built-in Dex

# Enable Prometheus metrics
metrics:
  enabled: true
  serviceMonitor:
    enabled: true
    additionalLabels:
      release: prometheus

controller:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

repoServer:
  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - gitlab.kube.huskypup.net
        - auth.kube.huskypup.net
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

applicationSet:
  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - gitlab.kube.huskypup.net
        - auth.kube.huskypup.net
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus