{{- $secret := include "clientSecret" . -}}
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
  name: headscale
  namespace: {{ .Release.Namespace }}
spec:
  grantTypes:
  - authorization_code
  responseTypes:
  - code
  scope: "openid profile email"
  secretName: {{ .Values.oauth2.secretName }}
  redirectUris:
  - https://{{ .Values.domain }}/oidc/callback
  hydraAdmin:
    url: {{ .Values.oauth2.hydraAdmin }}
    port: 80
    endpoint: /admin/clients
    forwardedProto: https
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.oauth2.secretName }}
  namespace: {{ .Release.Namespace }}
data:
  client_id: {{ .Values.oauth2.clientId | b64enc}}
  client_secret: {{ $secret | b64enc }}