{{- $secret := include "clientSecret" . -}}
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
  name: headscale
  namespace: {{ .Release.Namespace }}
spec:
  grantTypes:
  - authorization_code
  responseTypes:
  - code
  scope: "openid profile email"
  secretName: {{ .Values.oauth2.secretName }}
  redirectUris:
  - https://headscale.{{ .Values.domain }}/oidc/callback
  hydraAdmin:
    url: {{ .Values.oauth2.hydraAdmin }}
    port: 80
    endpoint: /clients
    forwardedProto: https