backstage-chart/templates/backstage-configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: backstage-config
  namespace: {{ .Values.namespaceOverride }}
  labels:
    {{- include "backstage.labels" . | nindent 4 }}
data:
  app-config.production.yaml: |
    app:
      title: {{ .Values.backstage.title }}
      baseUrl: {{ .Values.backstage.baseUrl }}
      {{- if .Values.backstage.ingressDomain }}
      environment:
        ingressDomain: {{ .Values.backstage.ingressDomain }}
        {{- if .Values.backstage.gitea }}
        gitea:
          {{- if .Values.backstage.gitea.inClusterUrl }}
          inClusterUrl: {{ .Values.backstage.gitea.inClusterUrl }}
          {{- end }}
          {{- if .Values.backstage.gitea.owner }}
          owner: {{ .Values.backstage.gitea.owner }}
          {{- end }}
        {{- end }}
      {{- end }}

    organization:
      name: {{ .Values.backstage.organization }}

    backend:
      baseUrl: {{ .Values.backstage.baseUrl }}
      listen:
        port: {{ .Values.service.targetPort }}
        host: 0.0.0.0

      csp:
        connect-src: ["'self'", 'http:', 'https:']

      cors:
        origin: {{ .Values.backstage.baseUrl }}
        methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
        credentials: true

      database:
        client: pg
        connection:
          host: ${POSTGRES_HOST}
          port: ${POSTGRES_PORT}
          user: ${POSTGRES_USER}
          password: ${POSTGRES_PASSWORD}
          database: {{ .Values.database.name }}

      auth:
        keys:
          - secret: ${BACKEND_SECRET}

      reading:
        allow:
          - host: raw.githubusercontent.com
          - host: github.com
          - host: '*.github.com'

    auth:
      environment: production
      session:
        secret: ${BACKEND_SECRET}
      # Configure allowed email domains for Google OAuth
      # Users with these email domains can sign in without User entities in catalog
      allowedEmailDomains:
        - onlinesales.ai
        # Add more domains if needed:
        # - partner-company.com
      providers:
        google:
          production:
            clientId: ${AUTH_GOOGLE_CLIENT_ID}
            clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
            # Custom domain-based resolver is configured in backend code
            # See packages/backend/src/plugins/auth.ts

    integrations:
      github:
        - host: github.com
          token: ${GITHUB_TOKEN}
      gitea:
        - baseUrl: {{ .Values.integrations.gitea.url }}
          host: {{ .Values.integrations.gitea.url | replace "https://" "" | replace "http://" "" }}
          username: ${GITEA_USERNAME}
          password: ${GITEA_PASSWORD}

    proxy:
      endpoints:
        '/argo-workflows/api':
          target: '{{ .Values.integrations.argoWorkflows.url }}'
          changeOrigin: true
          secure: true
          headers:
            Accept: 'application/json'
            Authorization: 'Bearer ${ARGO_WORKFLOWS_TOKEN}'

        '/argocd/api':
          target: '{{ .Values.integrations.argocd.url }}'
          changeOrigin: true
          secure: true

        '/gitea/api':
          target: '{{ .Values.integrations.gitea.url }}'
          changeOrigin: true
          secure: true
          headers:
            Authorization: 'Basic ${GITEA_AUTH_HEADER}'

        '/github/api':
          target: 'https://api.github.com'
          changeOrigin: true
          secure: true
          headers:
            Accept: 'application/vnd.github.v3+json'
            Authorization: 'Bearer ${GITHUB_TOKEN}'

    techdocs:
      builder: 'local'
      generator:
        runIn: 'local'
      publisher:
        type: 'local'

    scaffolder:
      defaultAuthor:
        name: backstage-scaffolder
        email: noreply@{{ .Values.backstage.baseUrl | replace "https://" "" | replace "http://" "" }}
      defaultCommitMessage: "backstage scaffolder"

    catalog:
      import:
        entityFilename: catalog-info.yaml
        pullRequestBranchName: backstage-integration
      rules:
        # Add User and Group to allowed entity kinds
        - allow: [Component, System, API, Resource, Location, Template, User, Group]
      locations:
      
        # Add organizational data location
        - type: url
          target: {{ .Values.integrations.gitea.url }}/gitea_admin/osmos-org/raw/branch/main/org.yaml
          rules:
            - allow: [User, Group]

    kubernetes:
      serviceLocatorMethod:
        type: 'multiTenant'
      clusterLocatorMethods:
        - type: 'config'
          clusters:
            - url: {{ .Values.integrations.kubernetes.clusterUrl }}
              name: backstage-cluster
              authProvider: 'serviceAccount'
              skipTLSVerify: false
              skipMetricsLookup: false

    argocd:
      appLocatorMethods:
        - type: 'config'
          instances:
            - name: production
              url: {{ .Values.integrations.argocd.url }}
              username: admin
              password: ${ARGOCD_AUTH_TOKEN}

    argoWorkflows:
      baseUrl: {{ .Values.integrations.argoWorkflows.url }}

    # Google Workspace Admin Directory API configuration
    # Used to list all organization users in the Admin page
    {{- if .Values.googleAdmin.enabled }}
    googleAdmin:
      # Service account credentials JSON from GCP Secret Manager
      serviceAccountCredentials: ${GOOGLE_ADMIN_SA_CREDENTIALS}
      # Admin email to impersonate (must have admin rights in Google Workspace)
      adminEmail: {{ .Values.googleAdmin.adminEmail }}
      # Domain to query for users
      domain: {{ .Values.googleAdmin.domain }}
      # Cache TTL in minutes
      cacheTtlMinutes: {{ .Values.googleAdmin.cacheTtlMinutes | default 5 }}
    {{- end }}