# Used to authorize access to keaycloak via tcp/443 on the hcloud firewall
keycloak_https_whitelisted_ips:
  - 0.0.0.0/0 # Public access to keycloak

# TODO migrate mobene completly to prodwork01
keycloak_ip_whitelist:
  - 167.235.150.133/32 # DEV-786 - prodwork01-kube-node-01
  - 167.235.150.197/32 # DEV-786 - prodwork01-kube-node-02
  - 23.88.53.161/32 # DEV-786 - prodwork01-kube-node-03
  - 195.201.113.110/32 # DEV-786 - prodwork01-kube-node-04
  - 5.75.184.216/32 # DEV-786 - prodwork01-kube-node-05
  - 91.107.228.133/32 # DEV-987 - prodwork01-kube-node-06
  - 167.235.25.0/32 # DEV-987 - prodwork01-kube-node-07

keycloak_customer_ips_mobene:
  - 92.42.192.128/25 # MOB-486 - mobene

# Use these Realm ACLs to create custom Traefik labels for Keycloak to restrict admin access per realm
# Both variables are mandatory!
# name: <realm_name>
# admin_ips: <ip/range in cidr notation>
keycloak_admin_realm_acls:
  - name: spkbz
    admin_ips:
      - 195.140.123.0/24 # DEV-628 - spk bautzen
      - 195.140.44.0/24 # DEV-628 - spk bautzen
      - 62.181.145.0/24 # DEV-628 - spk bautzen
      - 62.181.146.0/24 # DEV-628 - spk bautzen
  - name: sbsma
    admin_ips:
      - 195.200.47.243/32 # DEV-230 - sparda berlin
      - 195.200.47.244/32 # DEV-230 - sparda berlin
  - name: mobene
    admin_ips: "{{ keycloak_customer_ips_mobene + keycloak_ip_whitelist }}"
  - name: linde
    admin_ips:
      - 145.225.17.1/32 # DEV-1142 - Linde
      - 20.113.104.205/32 # DEV-1142 - Linde
      - 20.113.10.224/32 # DEV-1142 - Linde
