core/installer/values-tmpl/core-auth.cue

input: {
	network:   #Network
	subdomain: string
}

name:      "core-auth"
namespace: "core-auth"

_userSchema: ###"""
	{
	  "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
	  "$schema": "http://json-schema.org/draft-07/schema#",
	  "title": "User",
	  "type": "object",
	  "properties": {
		"traits": {
		  "type": "object",
		  "properties": {
			"username": {
			  "type": "string",
			  "format": "username",
			  "title": "Username",
			  "minLength": 3,
			  "ory.sh/kratos": {
				"credentials": {
				  "password": {
					"identifier": true
				  }
				}
			  }
			}
		  },
		  "additionalProperties": false
		}
	  }
	}
	"""###

out: {
	images: {
		kratos: {
			repository: "oryd"
			name:       "kratos"
			tag:        "v26.2.0-distroless"
			pullPolicy: "IfNotPresent"
		}
		hydra: {
			repository: "oryd"
			name:       "hydra"
			tag:        "v26.2.0-distroless"
			pullPolicy: "IfNotPresent"
		}
		ui: {
			repository: "giolekva"
			name:       "auth-ui"
			tag:        "latest"
			pullPolicy: "Always"
		}
		postgres: {
			repository: "library"
			name:       "postgres"
			tag:        "15.3"
			pullPolicy: "IfNotPresent"
		}
	}

	charts: {
		auth: {
			kind:    "GitRepository"
			address: "https://code.v1.dodo.cloud/helm-charts"
			branch:  "main"
			path:    "charts/auth"
		}
		postgres: {
			kind:    "GitRepository"
			address: "https://code.v1.dodo.cloud/helm-charts"
			branch:  "main"
			path:    "charts/postgresql"
		}
	}

	helm: {
		postgres: {
			chart: charts.postgres
			values: {
				fullnameOverride: "postgres"
				image: {
					registry:   images.postgres.registry
					repository: images.postgres.imageName
					tag:        images.postgres.tag
					pullPolicy: images.postgres.pullPolicy
				}
				service: {
					type: "ClusterIP"
					port: 5432
				}
				primary: {
					initdb: {
						scripts: {
							"init.sql": """
							CREATE USER kratos WITH PASSWORD 'kratos';
							CREATE USER hydra WITH PASSWORD 'hydra';
							CREATE DATABASE kratos WITH OWNER = kratos;
							CREATE DATABASE hydra WITH OWNER = hydra;
							"""
						}
					}
					persistence: {
						size: "1Gi"
					}
					securityContext: {
						enabled: true
						fsGroup: 0
					}
					containerSecurityContext: {
						enabled:   true
						runAsUser: 0
					}
				}
				volumePermissions: {
					securityContext: {
						runAsUser: 0
					}
				}
			}
		}
		auth: {
			chart: charts.auth
			dependsOn: [{
				name:      "postgres"
				namespace: release.namespace
			}]
			values: {
				kratos: {
					fullnameOverride: "kratos"
					image: {
						repository: images.kratos.fullName
						tag:        images.kratos.tag
						pullPolicy: images.kratos.pullPolicy
					}
					service: {
						admin: {
							enabled: true
							type:    "ClusterIP"
							port:    80
							name:    "http"
						}
						public: {
							enabled: true
							type:    "ClusterIP"
							port:    80
							name:    "http"
						}
					}
					ingress: {
						admin: enabled: false
						public: {
							enabled:   true
							className: input.network.ingressClass
							annotations: {
								"acme.cert-manager.io/http01-edit-in-place": "true"
								"cert-manager.io/cluster-issuer":            input.network.certificateIssuer
							}
							hosts: [{
								host: "accounts.\(input.network.domain)"
								paths: [{
									path:     "/"
									pathType: "Prefix"
								}]
							}]
							tls: [{
								hosts: ["accounts.\(input.network.domain)"]
								secretName: "cert-accounts.\(input.network.domain)"
							}]
						}
					}
					secret: {
						enabled: true
					}
					kratos: {
						automigration: {
							enabled: true
						}
						development: false
						courier: {
							enabled: false
						}
						config: {
							version: "v26.2.0"
							dsn:     "postgres://kratos:kratos@postgres.\(global.namespacePrefix)core-auth.svc:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4"
							serve: {
								public: {
									base_url: "https://accounts.\(input.network.domain)"
									cors: {
										enabled:           true
										debug:             false
										allow_credentials: true
										allowed_origins: [
											"https://\(input.network.domain)",
											"https://*.\(input.network.domain)",
										]
									}
								}
								admin: {
									base_url: "https://kratos-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
								}
							}
							selfservice: {
								default_browser_return_url: "https://accounts-ui.\(input.network.domain)"
								allowed_return_urls: [
									"https://*.\(input.network.domain)/",
									// TODO(gio): replace with input.network.privateSubdomain
									"https://*.\(global.privateDomain)",
								]
								methods: {
									password: {
										enabled: true
									}
								}
								flows: {
									error: {
										ui_url: "https://accounts-ui.\(input.network.domain)/error"
									}
									settings: {
										ui_url:                     "https://accounts-ui.\(input.network.domain)/settings"
										privileged_session_max_age: "15m"
									}
									recovery: {
										enabled: false
									}
									verification: {
										enabled: false
									}
									logout: {
										after: {
											default_browser_return_url: "https://accounts-ui.\(input.network.domain)/login"
										}
									}
									login: {
										ui_url:   "https://accounts-ui.\(input.network.domain)/login"
										lifespan: "10m"
										after: {
											password: {
												default_browser_return_url: "https://accounts-ui.\(input.network.domain)/"
											}
										}
									}
									registration: {
										style: "unified"
										lifespan: "10m"
										ui_url:   "https://accounts-ui.\(input.network.domain)/register"
										after: {
											password: {
												hooks: [{
													hook: "session"
												}]
												default_browser_return_url: "https://accounts-ui.\(input.network.domain)/"
											}
										}
									}
								}
							}
							log: {
								level:                 "debug"
								format:                "text"
								leak_sensitive_values: true
							}
							cookies: {
								path:      "/"
								same_site: "None"
								domain:    input.network.domain
							}
							secrets: {
								cookie: ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"]
							}
							hashers: {
								argon2: {
									parallelism: 1
									memory:      "128MB"
									iterations:  2
									salt_length: 16
									key_length:  16
								}
							}
							identity: {
								schemas: [{
									id:  "user"
									url: "file:///etc/config/identity.schema.json"
								}]
								default_schema_id: "user"
							}
							courier: {
								smtp: {
									connection_uri: "smtps://test-z1VmkYfYPjgdPRgPFgmeZ31esT9rUgS%40\(input.network.domain):iW%213Kk%5EPPLFrZa%24%21bbpTPN9Wv3b8mvwS6ZJvMLtce%23A2%2A4MotD@mx1.\(input.network.domain)"
								}
							}
						}
						identitySchemas: {
							"identity.schema.json": _userSchema
						}
					}
				}
				hydra: {
					fullnameOverride: "hydra"
					image: {
						repository: images.hydra.fullName
						tag:        images.hydra.tag
						pullPolicy: images.hydra.pullPolicy
					}
					service: {
						admin: {
							enabled: true
							type:    "ClusterIP"
							port:    80
							name:    "http"
						}
						public: {
							enabled: true
							type:    "ClusterIP"
							port:    80
							name:    "http"
						}
					}
					ingress: {
						admin: enabled: false
						public: {
							enabled:   true
							className: input.network.ingressClass
							annotations: {
								"acme.cert-manager.io/http01-edit-in-place": "true"
								"cert-manager.io/cluster-issuer":            input.network.certificateIssuer
							}
							hosts: [{
								host: "hydra.\(input.network.domain)"
								paths: [{
									path:     "/"
									pathType: "Prefix"
								}]
							}]
							tls: [{
								hosts: ["hydra.\(input.network.domain)"]
								secretName: "cert-hydra.\(input.network.domain)"
							}]
						}
					}
					secret: {
						enabled: true
					}
					maester: {
						enabled: false
					}
					hydra: {
						automigration: {
							enabled: true
						}
						config: {
							version: "v26.2.0"
							dsn:     "postgres://hydra:hydra@postgres.\(global.namespacePrefix)core-auth.svc:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4"
							serve: {
								cookies: {
									same_site_mode: "None"
								}
								public: {
									cors: {
										enabled:           true
										debug:             false
										allow_credentials: true
										allowed_origins: [
											"https://\(input.network.domain)",
											"https://*.\(input.network.domain)",
										]
									}
								}
								admin: {
									cors: {
										allowed_origins: [
											"https://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local",
										]
									}
									tls: {
										allow_termination_from: [
											"0.0.0.0/0",
											"10.42.0.0/16",
											"10.43.0.0/16",
										]
									}
								}
								tls: {
									allow_termination_from: [
										"0.0.0.0/0",
										"10.42.0.0/16",
										"10.43.0.0/16",
									]
								}
							}
							urls: {
								self: {
									public: "https://hydra.\(input.network.domain)"
									issuer: "https://hydra.\(input.network.domain)"
								}
								consent: "https://accounts-ui.\(input.network.domain)/consent"
								login:   "https://accounts-ui.\(input.network.domain)/login"
								logout:  "https://accounts-ui.\(input.network.domain)/logout"
							}
							secrets: {
								system: ["youReallyNeedToChangeThis"]
							}
							oidc: {
								subject_identifiers: {
									supported_types: [
										"pairwise",
										"public",
									]
									pairwise: {
										salt: "youReallyNeedToChangeThis"
									}
								}
							}
							log: {
								level:                 "trace"
								leak_sensitive_values: false
							}
						}
					}
				}
				ui: {
					certificateIssuer:  input.network.certificateIssuer
					ingressClassName:   input.network.ingressClass
					domain:             input.network.domain
					hydra:              "hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
					enableRegistration: false
					defaultReturnTo:    "https://launcher.\(global.domain)"
					image: {
						repository: images.ui.fullName
						tag:        images.ui.tag
						pullPolicy: images.ui.pullPolicy
					}
				}
			}
		}
	}
}