---
# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: oauth2-proxy
  namespace: oauth2-proxy
spec:
  interval: 30m
  chart:
    spec:
      chart: oauth2-proxy
      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: oauth2-proxy
        namespace: oauth2-proxy
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
    config:
      # OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
      existingSecret: oauth2-proxy-credentials
    extraArgs:
      provider: oidc
      # TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
      oidc-issuer-url: "REPLACE-ME"
      email-domain: "*"
      # Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
    # TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
    #   MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).