# Authentik Service Account for Memory Service (Phase 6.6)
# Encrypted version: authentik-memory.enc.yaml (via SOPS)
# 
# Prerequisites:
# 1. Create OAuth2 provider in Authentik: "poimen-memory-service"
# 2. Grant type: client_credentials  
# 3. Scopes: memory:read memory:write
# 4. Save to get client_id + client_secret
# 5. Replace placeholders below

apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-memory-service
  namespace: poimen
data:
  AUTHENTIK_MEMORY_SERVICE_CLIENT_ID: "poimen-memory-service"
  AUTHENTIK_TOKEN_ENDPOINT: "https://authentik.riotpiao.com/application/o/token/"
  AUTHENTIK_ISSUER: "https://authentik.riotpiao.com/application/o/poimen-memory/"
  AUTHENTIK_TOKEN_CACHE_TTL_SECS: "3600"
  WEBHOOK_RETRY_MAX_ATTEMPTS: "3"
  WEBHOOK_RETRY_BACKOFF_MS: "2000"
  WEBHOOK_TIMEOUT_SECS: "30"
  METRICS_ENDPOINT: "http://memory-service.poimen.svc.cluster.local:8080/metrics"
  METRICS_AUTH_ENABLED: "true"

---
apiVersion: v1
kind: Secret
metadata:
  name: authentik-memory-service
  namespace: poimen
type: Opaque
stringData:
  # REPLACE_WITH_ACTUAL_CLIENT_SECRET from Authentik UI
  AUTHENTIK_MEMORY_SERVICE_CLIENT_SECRET: "PLACEHOLDER_CLIENT_SECRET"