---
# oauth2-proxy — forward-auth for apps WITHOUT usable OIDC (PiHole, *arr UIs, qBittorrent, Homepage,
# Prometheus, Alertmanager, Hubble UI — ADR-0014). Authenticates users against the Keycloak `homelab`
# realm, then the Gateway ext-auth lets the request through only for an authenticated session
# (R-IDP-02: no management UI unauthenticated). Chart image is quay.io/oauth2-proxy (not Bitnami).
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: oauth2-proxy
  namespace: oauth2-proxy
spec:
  interval: 30m
  chart:
    spec:
      chart: oauth2-proxy
      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: oauth2-proxy
        namespace: oauth2-proxy
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
    config:
      # client-id / client-secret / cookie-secret from the SOPS secret (name only). client-id +
      # client-secret MUST match the realm's `oauth2-proxy` client (keycloak-realm-clients secret).
      existingSecret: oauth2-proxy-credentials
    extraArgs:
      provider: oidc
      oidc-issuer-url: https://keycloak.home.keithjackson.dev/realms/homelab
      # Forward-auth (ext-auth) mode: no upstream app; return 202 for an authenticated session so the
      # Gateway ext-authz can allow/deny. Auth headers are surfaced to the backend.
      reverse-proxy: "true"
      upstream: static://202
      set-xauthrequest: "true"
      pass-access-token: "true"
      email-domain: "*"
      # Single sign-in/callback host for all forward-auth-protected services on the platform zone.
      redirect-url: https://auth.home.keithjackson.dev/oauth2/callback
      whitelist-domain: ".home.keithjackson.dev"
      cookie-domain: ".home.keithjackson.dev"
      cookie-secure: "true"
      # Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
      # baseline here is "authenticated"; per-service `--allowed-groups` is layered on at the Gateway
      # ext-auth attachment (WS-NET contract) or via a dedicated oauth2-proxy instance per group.
      oidc-groups-claim: groups
      scope: "openid email profile"
    # Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
    metrics:
      enabled: true
    # TODO(WS-SEC/WS-NET, Phase 6): the Gateway ext-authz ATTACHMENT (which HTTPRoutes require this
    #   proxy, and each route's allowed groups) is a WS-NET Gateway contract — Cilium Gateway API
    #   ext-auth wiring. oauth2-proxy is the authenticator; the per-route enforcement is Gateway-side.