---
# Ingress for oauth2-proxy's sign-in/callback endpoint at auth.home.keithjackson.dev (docs/09). This
# is where forward-auth-protected UIs redirect unauthenticated users to log in against Keycloak. CR of
# the Gateway API CRDs — carried by platform-config. Same-namespace backend (no ReferenceGrant); the
# parentRef is allowed via the oauth2-proxy namespace's gateway-access=shared label.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: oauth2-proxy
  namespace: oauth2-proxy
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https
  hostnames:
    - auth.home.keithjackson.dev
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /oauth2
      backendRefs:
        - name: oauth2-proxy
          port: 80