charts: headscale oidc
diff --git a/charts/headscale/templates/config.yaml b/charts/headscale/templates/config.yaml
index 88ca0de..f4de425 100644
--- a/charts/headscale/templates/config.yaml
+++ b/charts/headscale/templates/config.yaml
@@ -263,36 +263,21 @@
# it is still being tested and might have some bugs, please
# help us test it.
# OpenID Connect
- # oidc:
- # only_start_if_oidc_is_available: true
- # issuer: "https://your-oidc.issuer.com/path"
- # client_id: "your-oidc-client-id"
- # client_secret: "your-oidc-client-secret"
- #
- # Customize the scopes used in the OIDC flow, defaults to "openid", "profile" and "email" and add custom query
- # parameters to the Authorize Endpoint request. Scopes default to "openid", "profile" and "email".
- #
- # scope: ["openid", "profile", "email", "custom"]
- # extra_params:
- # domain_hint: example.com
- #
- # List allowed principal domains and/or users. If an authenticated user's domain is not in this list, the
- # authentication request will be rejected.
- #
- # allowed_domains:
- # - example.com
- # Groups from keycloak have a leading '/'
- # allowed_groups:
- # - /headscale
- # allowed_users:
- # - alice@example.com
- #
- # If `strip_email_domain` is set to `true`, the domain part of the username email address will be removed.
- # This will transform `first-name.last-name@example.com` to the namespace `first-name.last-name`
- # If `strip_email_domain` is set to `false` the domain part will NOT be removed resulting to the following
- # namespace: `first-name.last-name.example.com`
- #
- # strip_email_domain: true
+ oidc:
+ only_start_if_oidc_is_available: false
+ issuer: {{ .Values.oauth2.hydraPublic }}
+ client_id: {{ .Values.oauth2.clientId }}
+ client_secret: {{ $secret }}
+ scope: ["openid", "profile", "email"]
+ extra_params:
+ domain_hint: lekva.me
+ allowed_domains:
+ - lekva.me
+ # allowed_groups:
+ # - /headscale
+ # allowed_users:
+ # - alice@example.com
+ strip_email_domain: true
# Logtail configuration
# Logtail is Tailscales logging and auditing infrastructure, it allows the control panel