apiVersion: v1
kind: ConfigMap
metadata:
  name: pgadmin-config
  namespace: platform-admin
  labels:
    app.kubernetes.io/name: pgadmin4
    app.kubernetes.io/instance: pgadmin
    app.kubernetes.io/part-of: platform
data:
  config_local.py: |
    import os

    AUTHENTICATION_SOURCES = ['oauth2', 'internal']
    OAUTH2_AUTO_CREATE_USER = True
    OAUTH2_CONFIG = [{
        'OAUTH2_NAME': 'keycloak',
        'OAUTH2_DISPLAY_NAME': 'Hyeonworks ID',
        'OAUTH2_CLIENT_ID': os.environ['PGADMIN_OIDC_CLIENT_ID'],
        'OAUTH2_CLIENT_SECRET': os.environ['PGADMIN_OIDC_CLIENT_SECRET'],
        'OAUTH2_SERVER_METADATA_URL': (
            'https://id.learn.hyeonworks.com/realms/hyeonworks/'
            '.well-known/openid-configuration'
        ),
        'OAUTH2_SCOPE': 'openid email profile',
        'OAUTH2_USERNAME_CLAIM': 'preferred_username',
        'OAUTH2_ADDITIONAL_CLAIMS': {
            'groups': ['/platform-db-admins'],
        },
    }]

    ALLOW_SAVE_PASSWORD = False
    ENHANCED_COOKIE_PROTECTION = False
    SESSION_COOKIE_SECURE = True
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = 'Lax'
    ALLOWED_HOSTS = ['db-admin.learn.hyeonworks.com']
    UPGRADE_CHECK_ENABLED = False
    SHOW_GRAVATAR_IMAGE = False
    LLM_ENABLED = False
    ENABLE_PSQL = False
    ENABLE_SERVER_PASS_EXEC_CMD = False