apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "marmot.fullname" . }}-config
  labels:
    {{- include "marmot.labels" . | nindent 4 }}
data:
  config.yaml: |
    {{- $config := deepCopy .Values.config }}
    {{- /* Strip secrets and Helm-only keys */}}
    {{- $_ := unset $config.server "encryptionKeySecretRef" }}
    {{- $_ := unset $config.server "autoGenerateEncryptionKey" }}
    {{- $_ := unset $config.database "passwordSecretRef" }}
    {{- if and (hasKey $config "search") (hasKey $config.search "elasticsearch") }}
    {{- $_ := unset $config.search.elasticsearch "passwordSecretRef" }}
    {{- end }}
    {{- range $name := list "okta" "google" "github" "gitlab" "keycloak" "slack" "auth0" "generic_oidc" }}
      {{- if hasKey $config.auth $name }}
        {{- $_ := unset (index $config.auth $name) "clientSecretRef" }}
      {{- end }}
    {{- end }}
    {{- toYaml $config | nindent 4 }}
