---
global:
  image:
    repository: "ghcr.io/goauthentik/server"
    tag: "2026.2.2"
    pullPolicy: IfNotPresent
authentik:
  postgresql:
    name: << database_name >>
    user: << database_user >>
<%- if database_external %>
    host: << database_host >>
    port: << database_port >>
<%- endif %>
<%- if email_enabled %>
  email:
    host: << email_host >>
    port: << email_port >>
    username: << email_username >>
    use_tls: << email_use_tls | lower >>
    from: << email_from >>
<%- endif %>
  error_reporting:
    enabled: << authentik_error_reporting | lower >>
  log_level: << authentik_log_level >>
server:
  service:
    type: << network_mode >>
<%- if traefik_enabled %>
  ingress:
    enabled: true
    ingressClassName: traefik
<%- if traefik_tls_enabled and traefik_tls_certmanager %>
    annotations:
      cert-manager.io/cluster-issuer: << certmanager_issuer >>
<%- endif %>
    hosts:
      - << traefik_host >>
<%- if traefik_tls_enabled %>
    tls:
      - secretName: << traefik_tls_secret >>
        hosts:
          - << traefik_host >>
<%- endif %>
<%- endif %>
postgresql:
<%- if database_external %>
  enabled: false
<%- else %>
  enabled: true
  auth:
    database: << database_name >>
    username: << database_user >>
<%- endif %>
redis:
  enabled: true