identity_providers:
  oidc:
    jwks:
      - key: |-
          ${repo.libs.util.indent(repo.vault.decrypt("encrypt$gAAAAABnOUxLHGPI8B_65SL7obl2v4_3E8J1i271tq-JfX2ohlz8PLydbQRI-wJlg-4kqm3Bp1jkH5BXa92KP9ZEseqadX7uLWU-9cVKj8WAUNlC3VoBFubNRb_crVKOavI3zCJd_9--CpTVCdR062EaR8AJUeiTLkTx8DU2CcaMFKLQ1nuUA4tpEk8dyVhvwtlbm8ItjCdvfl-CTBVE3LoczY6E_I35bKEcDvT_fS1Y6fDFV2S6PxRQSWLByfwsVFMkkHza1gNqvejaNggHxI-hjzlCHPdjlgpRBhd9Sd-Zs3u8PU5GhShhc2SlRv640QBzfrAcxckMDlYUcgvkcp38AiDF9rKgQiUfYSoHIg8dJJMP8pYHGYSIdCZQY7tw5Pdge_xVAEM3KIiIh6IPRm3iJ8ZG4HFq0Xjh42T86BCcYUsY_RGBBKaygf4UvDotlb3Np5v9mYc7jun8Z-DrGmEt6a5fHw9JlmFpbDaqp-pLzv9aq9TD9yGB-hisLTJbEjp3VzOc5GPhROH5qYxbeHqoisGeETNI575tOnS_MN-skJlWU2Uaglep1wH4gWyWRQqA-Xb5d2LZYenMldJ7DJhFCO8XgAcFgQrdma1MlmumEUmQYuM0IeOhq862rnO1UgQQ_gXOVyT4yYUSK3C0-s28slkN3b82tyyl7YzNKQpyUHGTIsKlDIpntX_TTy78wBJLjmF8C8RphZCixOFgrEvt8puBDvBLlJDkq4xgJTkExYsTsZaG-TJxXYtIR-yfWgTiMKnflFYK6um-JsaaIVfeKtcRdVao70V9vRaDER5DWE1XCCXWQru0BBMBbv_qpDeHYrjgZrkEhZZeXgveS-2f5PMlFFRhTkXRj-8qe9cO3qBsoZOBxLCCs_-ueyNH7jqw8_Yn8H-qrt5KI8MuKXTqwjQpbeW2JXiqusiqrVQElx3efNoCohdXtvSyTD7D-UriPij85he8sDJv_YouScHb3ItGbJrv0mPiAUO0iX_XA0I6Ck2jETlc6brzzmyKc23pdj-clkWZENouaiitoiYKECIlergumMmId0WjcMiXpA0Jwe8rfPT4S2QiemUsiM1u5SMkI6eSL8uQTUr_kavlUFV3r3yZqeQk1SpGT2hB_iMkqcNzliwk6J6n_ohqEzC8IP1yM4EzFKh2P2Q1n_Ro2MZsk7wjjLdm32895b_0o3FF-4pA4NSm0UZ-kvibebn-8TVhv2eRn-DsWgtzXDxWtAwBUtHKtQX6MZQVuswTZTSSuh6piQV4AnKaGpr7Gt1G0-VUG8QI9uuc-hBdwuZbS-q_d19UGabJxAw1Ssh3UOA__Bfhc9_2TZ2a6VKfzXih1-mxFQfA0EQJ4E4cktFfv6YEOlFsJ6ayfaCEJM4UhmuArKWLidaOnRVgO3qn-GG-p-q294O4Z1GSD8gddVrfdOymHRBjPbVMRvvQCUzvEdrt_oAqUWhG5ZenS6jF2aLZtDMVu-E87GKYKEDFSwybMRlEfiAS6GEySUB9MEGqrskf-u_esVv2U-luDV1GBhXi08n8RsLjOScEc59iZMC1CEFM0tG1kAPIE-57XK-Ja0tw3TofMXa6xauL8CnFMqYhdPTwUHeTwv7LM9n3kFksjAFcYAp8TeI-NPktswjFBsRaBc1-55BUJfhzKzL-DPJLHI_O7H9GhaSKlO0HGKcR7iUayR_GHfhdkAEZIdd5qXKOUIvd5o4n1klXrN1svBpRODlN3bmC6t9EmFYTSGSZNfNqrRrS7JNBioM0INuVQyqFXBqeavlTvSStEAaJxtCegt5bsqWNpuvQA06b7xyTcqiaQ8CaB9RzOx-xI7Vii0y-1gTjq35_rpndvNqVZC_hpPpTt-4ZQVJAmzYPZ6TIsiBcUTnOc1fRUEV1PtVJm0KhHWV_GNrHdkiHsmNtb759gKHo16-k2eyvOTUEXNwMRgQ3_U9PV2qXxoiAfiKFbgSDIy4qSdhsm2C4VREmlspkNEMgy6JB2QGygzrOs4uOS1p4lcbKvmhVllqqLyQ9nW_FkjkeibVQHvlKGX7V-NoFlWeyJ15XOupRb-3Wh8ibjOMD8IlX9vIhTJSJh54fy9DbrCo-UR8BIpP7JT0FeTKcbmjtmS7TuyRO8jpSqdiRys_rT-Ebgc-sq77uLpNBN1YBZU0VB848tSKM30Nl2wl-o9NBVh8tjGF8NsJyCoF0lR4w1rvVURNPj7dKsn6w_Qz4QKrTtUIo8jYkBy_VwbySJz6aN2CUM66_2h6_wxwopGaCYV18p3lhBe7u5WwqrCJ563b2VW7NBE5MD1AZbOCKmOWBSdnZud7Ee2U6nNr9jeAyDTCaut4NSS-ecDqnrDYxp9SSXVY="), " "*10, "not_first")}

    claims_policies:
      geopulse:
        id_token: ['email']

    clients:
      - client_id: jellyfin
        client_name: 'Jellyfin'
        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/jellyfin"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
        authorization_policy: one_factor
        redirect_uris:
          - https://tv.gzr.im/sso/OID/redirect/authelia
          - https://tv.gzr.im/sso/OID/r/authelia
        token_endpoint_auth_method: client_secret_post

      - client_id: paperless
        client_name: 'Paperless-ngx'
        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/paperless"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
        pkce_challenge_method: 'S256'
        authorization_policy: one_factor
        # consent_mode: implicit
        redirect_uris:
          - https://paper.gzr.im/accounts/oidc/authelia/login/callback/

      - client_id: immich
        client_name: 'Immich'
        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.password_for("authelia_client_secret_immich"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
        authorization_policy: one_factor
        token_endpoint_auth_method: client_secret_post
        redirect_uris:
          - https://photos.gzr.im/auth/login
          - https://photos.gzr.im/user-settings
          - https://photos.gzr.im/api/oauth/mobile-redirect
          - app.immich:///oauth-callback # required since immich v1.113.0

      - client_id: geopulse
        client_name: 'GeoPulse'
        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.password_for("authelia_client_secret_geopulse"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
        authorization_policy: one_factor
        token_endpoint_auth_method: client_secret_post
        redirect_uris:
          - https://where.gzr.im/oidc/callback
        claims_policy: geopulse

      - client_id: calibre
        client_name: 'Calibre-Web-Automated'
        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.password_for("authelia_client_secret_calibre"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
        authorization_policy: one_factor
        token_endpoint_auth_method: client_secret_basic
        redirect_uris:
          - https://calibre.gzr.im/login/generic/authorized