Listen 4000

<VirtualHost *:4000>
    ServerName git.prole.org

    LogLevel info
    ErrorLog /proc/self/fd/2
    CustomLog /proc/self/fd/1 combined

    # Health check endpoint — no auth required (used by k8s probes)
    <Location /_healthz>
        AuthType None
        Require all granted
    </Location>

    # GSSAPI/SPNEGO — all other paths require a valid Kerberos ticket
    # Keytab contains HTTP/git.prole.org@PROLE.ORG (stored as gitea-krb5-keytab secret)
    <Location />
        AuthType GSSAPI
        AuthName "Kerberos - PROLE.ORG"
        GssapiCredStore keytab:/etc/krb5/http.keytab
        GssapiLocalName on
        Require valid-user

        # Inject bare username into X-WEBAUTH-USER for Gitea reverse proxy login.
        # Strip the @REALM suffix if GssapiLocalName didn't resolve it.
        RequestHeader set X-WEBAUTH-USER "%{REMOTE_USER}e"
        RequestHeader edit X-WEBAUTH-USER "@.*$" ""
    </Location>

    ProxyPreserveHost On
    ProxyPass /_healthz !
    ProxyPass / http://gitea-http.gitea.svc.cluster.local:3000/
    ProxyPassReverse / http://gitea-http.gitea.svc.cluster.local:3000/
</VirtualHost>