# oauth2-proxy values for the prole.org k3s homelab cluster.
#
# Gates Supabase Studio at db.prole.org behind Google OAuth.
# Restricts access to @prole.org Workspace accounts.
# Credentials are read from Kubernetes Secret oauth2-proxy-prole-secret
# (keys: client-id, client-secret, cookie-secret) — never hardcoded here.
#
# Deploy:
#   kubectl create secret generic oauth2-proxy-prole-secret \
#     --namespace supabase \
#     --from-literal=client-id="<from Google Cloud Console>" \
#     --from-literal=client-secret="<from Google Cloud Console>" \
#     --from-literal=cookie-secret="$(openssl rand -base64 32 | tr -- '+/' '-_')"
#
#   helm upgrade --install oauth2-proxy ./supabase/helm/oauth2-proxy \
#     --namespace supabase \
#     --values ./supabase/helm/oauth2-proxy/values-k3s.yaml

replicaCount: 1

image:
  repository: quay.io/oauth2-proxy/oauth2-proxy
  tag: v7.15.2
  pullPolicy: IfNotPresent

# Kubernetes Secret containing OAuth2 credentials.
# Keys must be: client-id, client-secret, cookie-secret
# Real values: Google Cloud Console → APIs & Services → Credentials
#              Project: prole.org, OAuth 2.0 client for "Supabase Studio"
credentialsSecret:
  name: oauth2-proxy-prole-secret

provider:
  # Use Google OAuth directly (not OIDC broker) for prole.org Workspace.
  name: google
  oidcIssuerUrl: https://accounts.google.com
  # Restrict to prole.org Google Workspace accounts only.
  emailDomain: prole.org

redirect:
  url: https://db.prole.org/oauth2/callback

# Upstream: Supabase Studio service in the supabase namespace.
upstream: http://supabase-studio.supabase.svc.cluster.local:3000

cookie:
  secure: true
  domain: .prole.org
  name: _knoe_oauth2

# Pass authenticated identity headers to the upstream.
headers:
  setXAuthRequest: true
  passAccessToken: true

# Bypass Google auth for Supabase API surfaces — Kong's key-auth enforces
# anon/service-role keys on these paths.
skipAuthRoutes:
  - ^/(auth|rest|realtime|storage|functions|graphql)/v1/.*
  - ^/pg/.*

service:
  type: ClusterIP
  port: 80
  targetPort: 4180

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    cpu: 100m
    memory: 128Mi