apiVersion: v1
kind: ConfigMap
metadata:
  name: librechat-config
  namespace: librechat
data:
  HOST: "0.0.0.0"
  PORT: "3080"
  DOMAIN_CLIENT: "https://librechat.sttlab.local"
  DOMAIN_SERVER: "https://librechat.sttlab.local"
  MEILI_HOST: "http://meilisearch:7700"
  NODE_ENV: "production"
  ALLOW_EMAIL_LOGIN: "true"
  ALLOW_REGISTRATION: "true"
  ALLOW_SOCIAL_LOGIN: "true"
  ALLOW_SOCIAL_REGISTRATION: "true"
  # Keycloak SSO, additive alongside email/password login (not replacing it
  # — ALLOW_EMAIL_LOGIN stays true). OPENID_CLIENT_SECRET/OPENID_SESSION_SECRET
  # are in librechat-secrets (see librechat/deployment.yaml).
  OPENID_ISSUER: "https://keycloak.sttlab.local/realms/classic-models"
  OPENID_CLIENT_ID: "librechat"
  OPENID_CALLBACK_URL: "/oauth/openid/callback"
  OPENID_SCOPE: "openid profile email librechat-audience"
  OPENID_BUTTON_LABEL: "classic-models SSO"
  # RP-initiated logout — without this, switching Keycloak users silently
  # reuses the existing SSO session instead of re-prompting.
  OPENID_USE_END_SESSION_ENDPOINT: "true"
  SESSION_EXPIRY: "900000"
  REFRESH_TOKEN_EXPIRY: "604800000"
  DEBUG_LOGGING: "false"
  OTEL_TRACING_ENABLED: "true"
  OTEL_SERVICE_NAME: "librechat"
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.observability.svc.cluster.local:4318"
  OTEL_TRACES_EXPORTER: "otlp"