# {{ ansible_managed }}
PODMAN_ARGS="\
    --name 'cadoles-pod-hydra-v1' \
    --replace \
    --network=slirp4netns:allow_host_loopback=true \
    -p 127.0.0.1:4444:4444 \
    -p 127.0.0.1:4445:4445 \
    --tmpfs /tmp \
    --tz=local \
    -e 'HYDRA_DSN=mysql://{{ hydra_database_user }}:{{ hydra_database_password }}@tcp({{ hydra_database_host }}:{{ hydra_database_port }})/{{ hydra_database_name }}?parseTime=true' \
    -e 'LOG_LEVEL={{ hydra_log_level }}' \
    -e 'LOG_LEAK_SENSITIVE_VALUES={{ hydra_log_leak_sensitive_values }}' \
    -e 'HYDRA_URLS_SELF_ISSUER={{ hydra_urls_self_issuer_url }}' \
    -e 'HYDRA_URLS_CONSENT={{ hydra_urls_consent }}' \
    -e 'HYDRA_URLS_LOGIN={{ hydra_urls_login }}' \
    -e 'HYDRA_URLS_LOGOUT={{ hydra_urls_logout }}' \
    -e 'HYDRA_URLS_ERROR={{ hydra_urls_error }}' \
    -e 'HYDRA_URL_POST_LOGOUT={{ hydra_url_post_logout }}' \
    -e 'HYDRA_ALLOW_INSECURE=yes' \
    -e 'HYDRA_LEVEL={{ hydra_log_level }}' \
    -e 'TTL_REFRESH_TOKEN={{ hydra_ttl_refresh_token }}'\
    {% if hydra_public_cors_allowed_origins | default([]) | length > 0 %}
    -e 'SERVE_PUBLIC_CORS_ENABLED=true' \
    -e 'SERVE_PUBLIC_CORS_ALLOWED_ORIGINS={{ hydra_public_cors_allowed_origins | join(',') }}' \
    {% endif %}
    -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
    -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
    -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
    -v /etc/hydra/clients.d:/etc/hydra/clients.d \
"