---
# --- Automation Orchestrator instance ---
# Defaults track the automation_orchestrator_operator role's variables when set.
automation_orchestrator_oidc_namespace: "{{ automation_orchestrator_operator_app_namespace | default('automation-orchestrator') }}"
automation_orchestrator_oidc_instance_name: "{{ automation_orchestrator_operator_instance_name | default('automation-orchestrator') }}"
# Public base URL of the AO UI/API; "" derives it from the instance's Route.
automation_orchestrator_oidc_url: ""
automation_orchestrator_oidc_admin_user: admin
automation_orchestrator_oidc_validate_certs: true

# --- Keycloak ---
automation_orchestrator_oidc_keycloak_url: ""
automation_orchestrator_oidc_keycloak_realm: ""
automation_orchestrator_oidc_keycloak_admin_user: ""
automation_orchestrator_oidc_keycloak_admin_password: ""
automation_orchestrator_oidc_keycloak_validate_certs: true
automation_orchestrator_oidc_client_id: automation-orchestrator
# Create the Keycloak groups named in group_mappings (membership is managed in Keycloak).
automation_orchestrator_oidc_create_keycloak_groups: true

# --- AO identity provider ---
automation_orchestrator_oidc_provider_name: Keycloak
# Keycloak group (from the "groups" claim) -> AO built-in group (admins, auditors, users).
# Users in no mapped group are refused login.
automation_orchestrator_oidc_group_mappings: []
#   - idp_group: ao-admins
#     group: admins
automation_orchestrator_oidc_rp_initiated_logout: true
# PATCH the provider even when its config is unchanged (e.g. to push a rotated client secret).
automation_orchestrator_oidc_force_update: false

# The backend rejects OIDC issuers that resolve to private IPs unless this is set, and
# the AutomationOrchestrator CR has no field for it — so the role sets the env var on the
# backend Deployment directly. Re-run the role if the operator ever reverts it.
automation_orchestrator_oidc_allow_private_networks: true

# --- Debugging ---
automation_orchestrator_oidc_no_log: true