{{- if eq (.Values.oidc.enabled | toString) "true" }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spire.fullname" . }}-oidc-discovery-provider
  namespace: {{ .Release.Namespace }}
data:
  oidc-discovery-provider.conf: |
    log_level = "{{ .Values.oidc.logLevel }}"
    {{ if gt (len .Values.oidc.domains) 0 }}
    domains = ["{{- join "\", \"" .Values.oidc.domains }}"]
    {{ else }}
    domains = []
    {{ end }}
    {{- if .Values.oidc.insecureScheme.enabled }}
    allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
    listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
    {{- else }}
    acme {
        directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
        cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
        tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
        email = "{{ .Values.oidc.acme.emailAddress }}"
    }
    {{- end }}

    workload_api {
        socket_path = "/run/spire/agent-sockets/agent.sock"
        trust_domain = "{{ .Values.spire.trustDomain }}"
    }
  {{- if .Values.oidc.insecureScheme.enabled }}
  default.conf.template: |
    upstream oidc {
      server unix:/run/spire/oidc-sockets/oidc-server.sock;
    }

    server {
      listen            80;
      listen       [::]:80;

      location / {
        proxy_pass http://oidc;
        proxy_set_header Host $host;
      }
    }
  {{- end }}
{{ end }}