{{- $portals := include "tfa.portals" . | fromYamlArray -}}
{{- $domains := include "tfa.domains" . | fromYamlArray -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-config
  labels:
    {{- include "tfa.labels" . | nindent 4 }}
data:
  config.yaml: |
    server:
      # One entry per domain served. `domain` scopes the session cookie and
      # `authHost` is where this service is reachable for that domain.
      domains:
        {{- range $domains }}
        - domain: {{ .domain | quote }}
          authHost: {{ .authHost | quote }}
        {{- end }}

    tokens:
      sessionLifetime: {{ .Values.tokens.sessionLifetime }}

    portals:
      {{- range $portals }}
      - name: {{ .name | quote }}
        providers:
          - pocketID:
              endpoint: {{ .endpoint | quote }}
              clientID: {{ .clientID | quote }}
              clientSecretFile: "{{ include "tfa.secretDir" $ }}/{{ .name }}/client-secret"
      {{- end }}
    {{- with .Values.extraConfig }}
    {{ . | nindent 4 }}
    {{- end }}