# oauth2-proxy gate in front of Supabase Studio at db.prole.org (k3s homelab).
#
# Sits between the Traefik ingress and supabase-kong; redirects unauthenticated
# requests to Google Workspace (prole.org), allows any @prole.org identity through,
# then proxies the request upstream to supabase-kong:8000.
#
# Bootstrap: ./etc/init_oauth2_proxy_prole.sh
# Cluster:   k3s homelab (myrddin/merlin/gandalf)
# Namespace: supabase
#
# After this Deployment is Ready, patch the Traefik IngressRoute (or the
# db.prole.org Ingress) to route through oauth2-proxy:80 instead of
# supabase-kong:8000 directly.
#
# skip-auth-route rules mirror the knoe.dev deployment — Kong key-auth is
# the enforcer on API paths; only the Studio UI at / is Google-gated.
#
# When knoe-auth Round 1 ships an OIDC OP, swap --provider=google to
# --provider=oidc --oidc-issuer-url=https://api.prole.org/auth.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: oauth2-proxy
  namespace: supabase
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: knoe-installer
---
apiVersion: v1
kind: Service
metadata:
  name: oauth2-proxy
  namespace: supabase
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: knoe-installer
spec:
  type: ClusterIP
  selector:
    app: oauth2-proxy
  ports:
    - name: http
      port: 80
      targetPort: 4180
      protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: oauth2-proxy
  namespace: supabase
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: knoe-installer
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: oauth2-proxy
  template:
    metadata:
      labels:
        app: oauth2-proxy
    spec:
      serviceAccountName: oauth2-proxy
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: oauth2-proxy
          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
          imagePullPolicy: IfNotPresent
          args:
            # Switched from --provider=google to OIDC via knoe-auth (Phase 2).
            # Authentication flow: oauth2-proxy → knoe-auth /authorize → Google → knoe-auth /callback/google → oauth2-proxy /callback
            # The db-prole-org Google OAuth client (https://db.prole.org/oauth2/callback) is now unused.
            - --provider=oidc
            - --oidc-issuer-url=https://api.prole.org/auth
            - --email-domain=prole.org
            - --upstream=http://supabase-kong:8000
            - --http-address=0.0.0.0:4180
            - --reverse-proxy=true
            - --cookie-secure=true
            - --cookie-name=_prole_studio_oauth2
            - --cookie-domain=db.prole.org
            - --whitelist-domain=db.prole.org
            - --redirect-url=https://db.prole.org/oauth2/callback
            - --skip-provider-button=true
            - --scope=openid email profile
            # Do NOT set --pass-authorization-header / --set-authorization-header.
            # Those would clobber the Authorization: Bearer <apikey> that
            # supabase-py and Studio send to Kong's key-auth plugin.
            - --skip-auth-route=^/(auth|rest|realtime|storage|functions|graphql)/v1/.*
            - --skip-auth-route=^/pg/.*
            - --skip-auth-route=^/onboard\.html$
            - --skip-auth-route=^/support$
            - --request-logging=true
            - --auth-logging=true
            - --standard-logging=true
          env:
            - name: OAUTH2_PROXY_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: oauth2-proxy-google-oidc
                  key: client_id
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: oauth2-proxy-google-oidc
                  key: client_secret
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  name: oauth2-proxy-google-oidc
                  key: cookie_secret
          ports:
            - name: http
              containerPort: 4180
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /ping
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          readinessProbe:
            httpGet:
              path: /ping
              port: http
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true