argo-cd:
  dex:
    enabled: true
  server:
    rbacConfig:
      policy.csv: |
        g, roxedus, role:admin
        g, ArgoCD Admins, role:admin
    service:
      type: NodePort
    extraArgs:
      - --insecure

    ingress:
      enabled: true
      ingressClassName: traefik
      annotations:
        cert-manager.io/acme-challenge-type: dns01
        cert-manager.io/cluster-issuer: roxedus.com-cloudflare
      hosts:
        - argo.roxedus.com
      tls:
        - hosts:
            - argo.roxedus.com
          secretName: argo-roxedus-com-cert

    config:
      accounts.roxedus: apiKey, login
      accounts.admin.enabled: "true"
      repositories: |
        - type: helm
          name: argo-cd
          url: https://argoproj.github.io/argo-helm
  configs:
    cm:
      admin.enabled: false
      url: https://argo.roxedus.com

      resource.customizations.health.networking.k8s.io_Ingress: |
        hs = {}
        hs.status = "Healthy"
        return hs

      resource.customizations.health.cert-manager.io_Certificate: |
        hs = {}
        if obj.status ~= nil then
          if obj.status.conditions ~= nil then
            for i, condition in ipairs(obj.status.conditions) do
              if condition.type == "Ready" and condition.status == "False" then
                hs.status = "Degraded"
                hs.message = condition.message
                return hs
              end
              if condition.type == "Ready" and condition.status == "True" then
                hs.status = "Healthy"
                hs.message = condition.message
                return hs
              end
            end
          end
        end

        hs.status = "Progressing"
        hs.message = "Waiting for certificate"
        return hs

      dex.config: |

        connectors:
        - config:
            issuer: https://authentik.roxedus.com/application/o/argo/
            clientID: 509095b1ecd5117c95b9a2879d1cbcd5adc0b5d9
            clientSecret: $authentik-sso:oidc.auth0.clientSecret
            insecureEnableGroups: true
            scopes:
              - openid
              - profile
              - email
              - groups
          name: authentik
          type: oidc
          id: authentik