global:
  domain: cd.brunner.ninja

crds:
  install: true

configs:
  cm:
    oidc.config: |
      name: Authentik
      issuer: https://auth.brunner.ninja/application/o/argocd/
      clientID: argocd
      clientSecret: $argocd-oidc:client-secret
      requestedScopes: ["openid", "profile", "email", "groups"]
      requestedIDTokenClaims:
        groups:
          essential: true
  rbac:
    policy.csv: |
      g, authentik Admins, role:admin
    policy.default: ''
    scopes: '[groups]'
  secret:
    # Preserve the existing argocd-secret; no secret values belong in Git.
    createSecret: false
  params:
    server.insecure: true

notifications:
  secret:
    # Preserve the existing argocd-notifications-secret.
    create: false

redisSecretInit:
  # Preserve the existing argocd-redis Secret without giving CI Secret access.
  enabled: false

server:
  ingress:
    enabled: true
#    ingressClassName: traefik
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure