---
# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
# /config/plugins/configurations/ by the inject-plugin-config initContainer,
# which substitutes the OidSecret / LdapBindPassword placeholders from the
# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
# provider key "authentik" must match the redirect path segment registered on
# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
# latter via akR-global-admin).
apiVersion: v1
kind: ConfigMap
metadata:
  name: fafflix-plugin-config
  namespace: fafflix
data:
  SSO-Auth.xml: |
    <?xml version="1.0" encoding="utf-8"?>
    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <SamlConfigs />
      <OidConfigs>
        <item>
          <key>
            <string>authentik</string>
          </key>
          <value>
            <PluginConfiguration>
              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
              <OidClientId>jellyfin</OidClientId>
              <OidSecret>@@CLIENT_SECRET@@</OidSecret>
              <Enabled>true</Enabled>
              <EnableAuthorization>true</EnableAuthorization>
              <EnableAllFolders>true</EnableAllFolders>
              <EnabledFolders />
              <AdminRoles>
                <string>akP-jellyfin-admin</string>
              </AdminRoles>
              <Roles>
                <string>akP-jellyfin-user</string>
                <string>akP-jellyfin-admin</string>
              </Roles>
              <EnableFolderRoles>false</EnableFolderRoles>
              <EnableLiveTvRoles>false</EnableLiveTvRoles>
              <EnableLiveTv>false</EnableLiveTv>
              <EnableLiveTvManagement>false</EnableLiveTvManagement>
              <LiveTvRoles />
              <LiveTvManagementRoles />
              <FolderRoleMappings />
              <RoleClaim>ak_groups</RoleClaim>
              <OidScopes>
                <string>openid</string>
                <string>profile</string>
                <string>email</string>
                <string>ak_groups</string>
              </OidScopes>
              <CanonicalLinks></CanonicalLinks>
              <DisableHttps>false</DisableHttps>
              <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
              <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
              <SchemeOverride>https</SchemeOverride>
            </PluginConfiguration>
          </value>
        </item>
      </OidConfigs>
    </PluginConfiguration>
  LDAP-Auth.xml: |
    <?xml version="1.0" encoding="utf-8"?>
    <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
      <LdapPort>6636</LdapPort>
      <UseSsl>true</UseSsl>
      <UseStartTls>false</UseStartTls>
      <SkipSslVerify>true</SkipSslVerify>
      <LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
      <LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
      <LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
      <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
      <LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
      <LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
      <EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
      <LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
      <CreateUsersFromLdap>true</CreateUsersFromLdap>
      <AllowPassChange>false</AllowPassChange>
      <LdapUidAttribute>cn</LdapUidAttribute>
      <LdapUsernameAttribute>cn</LdapUsernameAttribute>
      <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
      <EnableAllFolders>true</EnableAllFolders>
      <EnabledFolders />
    </PluginConfiguration>
  branding.xml: |
    <?xml version="1.0" encoding="utf-8"?>
    <BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <LoginDisclaimer>&lt;p style="text-align:center"&gt;&lt;a href="/sso/OID/start/authentik"&gt;Sign in with SSO&lt;/a&gt;&lt;/p&gt;</LoginDisclaimer>
      <CustomCss></CustomCss>
      <SplashscreenEnabled>false</SplashscreenEnabled>
    </BrandingOptions>