apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: tinyauth
  namespace: auth
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: tinyauth
  driftDetection:
    mode: enabled
  values:
    controllers:
      tinyauth:
        containers:
          app:
            image:
              repository: ghcr.io/tinyauthapp/tinyauth
              tag: v5.2.0
            env:
              TZ: Europe/Moscow
              TINYAUTH_APPURL: https://login.aggtaa.com
              TINYAUTH_UI_TITLE: "Welcome"
              TINYAUTH_RESOURCES_PATH: /resources
              TINYAUTH_UI_BACKGROUNDIMAGE: /resources/background.webp
              TINYAUTH_AUTH_USERSFILE: /config/users
              TINYAUTH_AUTH_SECURECOOKIE: "true"
              TINYAUTH_LABELPROVIDER: none
              TINYAUTH_ANALYTICS_ENABLED: "false"
              TINYAUTH_DATABASE_DRIVER: memory
              TINYAUTH_OIDC_PRIVATEKEYPATH: /oidc/key.pem
              TINYAUTH_OIDC_PUBLICKEYPATH: /oidc/key.pub

              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTID: filebrowser-quantum
              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_NAME: files.aggtaa.com
              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_TRUSTEDREDIRECTURIS: https://files.aggtaa.com/api/auth/oidc/callback
              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET:
                valueFrom:
                  secretKeyRef:
                    name: tinyauth-secrets
                    key: TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET

              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTID: markdown-vault-mcp
              TINYAUTH_OIDC_CLIENTS_MDVAULT_NAME: markdown-vault-mcp
              TINYAUTH_OIDC_CLIENTS_MDVAULT_TRUSTEDREDIRECTURIS: https://md-vault.mcp.aggtaa.com/auth/callback
              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET:
                valueFrom:
                  secretKeyRef:
                    name: tinyauth-secrets
                    key: TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true
            resources:
              requests:
                cpu: 20m
                memory: 64Mi
              limits:
                memory: 256Mi

    service:
      app:
        controller: tinyauth
        ports:
          http:
            port: 3000

    ingress:
      app:
        className: traefik
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: login.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: tinyauth-tls
            hosts:
              - login.aggtaa.com

    persistence:
      users:
        type: secret
        name: tinyauth-secrets
        globalMounts:
          - path: /config/users
            subPath: users
            readOnly: true
      oidc-key:
        type: secret
        name: tinyauth-oidc-key
        globalMounts:
          - path: /oidc
            readOnly: true
      resources:
        type: configMap
        name: tinyauth-resources
        globalMounts:
          - path: /resources
            readOnly: true