# ------------------------------------------------------------------------------
# argocd-cm — ArgoCD Core Configuration
#
# Configures:
#   - ArgoCD public URL (used in Dex redirect URIs)
#   - Dex connector to Authentik OIDC
#   - Gitea repo credentials reference
#
# Authentik side setup (manual — do this in guest-relations before bootstrapping):
#   1. Admin UI → Applications → Create New Application
#   2. Provider type: OAuth2/OpenID Connect
#   3. Name: argocd
#   4. Authorization flow: default-provider-authorization-explicit-consent
#   5. Client type: Confidential
#   6. Strict redirect URIs:
#        https://argocd.local.mk-labs.cloud/api/dex/callback
#        http://localhost:8085/auth/callback        (ArgoCD CLI)
#   7. Scopes: openid, profile, email, groups
#   8. Note the Client ID and Client Secret → store in 1Password as:
#        Item: "argocd-oidc"
#        Fields: client-id, client-secret
#   9. Create two groups in Authentik:
#        - argocd-admins  (add your user)
#        - argocd-viewers (read-only users)
# ------------------------------------------------------------------------------
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Public URL — must match the HTTPRoute hostname
  url: https://argocd.local.mk-labs.cloud

  # Dex connector to Authentik
  # Using Dex (not native OIDC) to preserve ArgoCD CLI functionality
  dex.config: |
    connectors:
      - type: oidc
        id: authentik
        name: Authentik
        config:
          # Authentik OIDC issuer — slug must match the Application slug in Authentik
          # Slug is auto-generated from the app name, usually lowercase with hyphens
          issuer: https://authentik.local.mk-labs.cloud/application/o/argocd/
          clientID: $dex.authentik.clientID
          clientSecret: $dex.authentik.clientSecret
          redirectURI: https://argocd.local.mk-labs.cloud/api/dex/callback
          scopes:
            - openid
            - profile
            - email
            - groups
          insecureEnableGroups: true
          groupsKey: groups
          userIDKey: sub
          userNameKey: preferred_username
          emailKey: email

  # Gitea repo — ArgoCD needs credentials to pull from your private repo
  # Credentials are stored as a Repository secret (see repository-secret.yaml)
  # This tells ArgoCD to use SSH for the repo
  repositories: |
    - url: git@gitea.mk-labs.cloud:rblundon/homelab.git
      type: git
      name: homelab

  # Resource tracking via annotation (recommended over label tracking)
  application.resourceTrackingMethod: annotation