# oauth2-proxy Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
#
# replicaCount: ${OAUTH2_PROXY_REPLICAS}       # overlay knob (dev 1 / prod 2 HA)
# provider: oidc, oidc-issuer-url = Keycloak realm   (Phase 6)
# config.existingSecret: oauth2-proxy-credentials    (client id/secret + cookie secret; SOPS — name only)
# Forward-auth wired at the Gateway (ext-auth) for non-OIDC apps (ADR-0014) — contract with WS-NET.
# Protects: PiHole, *arr UIs, qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI.