apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-grafana-proxy-nginx
data:
  nginx.conf: |
    worker_processes  1;
    events { worker_connections  1024; }
    http {
      map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
      }

      server {
        listen 80;
        server_name _;

        # Never trust inbound auth headers from clients.
        proxy_set_header X-WEBAUTH-USER "";
        proxy_set_header X-Knoe-Groups "";

        location = /_auth_verify {
          internal;
          proxy_pass http://knoe-auth:8080/auth/verify;
          proxy_pass_request_body off;
          proxy_set_header Content-Length "";
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-Host $host;
        }

        # Pass Google OAuth and Grafana login paths through without auth_request
        # so auth.google sign-in can complete. Kerberos users still reach Grafana
        # via the auth_request path below and get X-WEBAUTH-USER injected.
        location = /grafana/login/google {
          proxy_set_header X-WEBAUTH-USER "";
          proxy_set_header X-Knoe-Groups "";
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_http_version 1.1;
          proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
        }

        location ~ ^/grafana/login(/.*)?$ {
          proxy_set_header X-WEBAUTH-USER "";
          proxy_set_header X-Knoe-Groups "";
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_http_version 1.1;
          proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
        }

        location / {
          auth_request /_auth_verify;
          auth_request_set $knoe_user $upstream_http_x_knoe_user;
          auth_request_set $knoe_groups $upstream_http_x_knoe_groups;

          error_page 401 = @login;
          error_page 403 = @login;

          proxy_set_header X-WEBAUTH-USER $knoe_user;
          proxy_set_header X-Knoe-Groups $knoe_groups;
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;

          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection $connection_upgrade;

          proxy_pass http://kps-grafana.monitoring.svc.cluster.local:80;
        }

        location @login {
          return 302 https://api.knoe.org/auth/login?next=$scheme://$host$request_uri;
        }
      }
    }