---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ghp-env
  namespace: ghp
data:
  GHP_DATABASE_DRIVER: postgres
  # ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
  # for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
  # the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
  #
  # Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
  # into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
  # :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
  # GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
  # that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
  #
  # nonroot cannot bind <1024; listen high and remap in the Service.
  GHP_SERVER_LISTEN: ":8080"
  # Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
  # for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
  GHP_SERVER_TRUST_PROXY_HEADERS: "true"
  GHP_METRICS_LISTEN: ":9136"
  GHP_METRICS_ENABLED: "true"
  GHP_SERVER_BASE_URL: https://ghp.unkin.net
  GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net
  # private_key key from the ghp-github-app Secret, mounted as a file.
  GHP_GITHUB_PRIVATE_KEY_FILE: /etc/ghp/github-app/private_key
  # cert-manager Certificate ghp-tls, mounted from the ghp-tls Secret.
  GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
  GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
  # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
  GHP_ADMINS: "neoloc"