apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy-google-oidc
  namespace: supabase
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: knoe-installer
# Google OAuth 2.0 client credentials + cookie secret for the oauth2-proxy
# gating Supabase Studio at db.0.knoe.dev. Applied by etc/init_oauth2_proxy.sh
# via envsubst from etc/secrets/oauth2-proxy-{client-id,client-secret,cookie-secret}.
#
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
# - Application type: Web application
# - Name: knoe.dev Studio
# - Authorized JavaScript origins: https://db.0.knoe.dev
# - Authorized redirect URIs: https://db.0.knoe.dev/oauth2/callback
# - OAuth consent screen: Internal (knoey.com Workspace)
# - Scopes: openid, email, profile (default for oauth2-proxy)
#
# cookie_secret: must be 32 bytes (24-byte base64-encoded). Generate with:
#   openssl rand -base64 32
#
# Why a separate client (not reusing knoe.dev GitLab): independent rotation
# surface — if Studio access is compromised, rotating one client doesn't
# disrupt the GitLab login flow (and vice versa).
type: Opaque
stringData:
  client_id: "${OAUTH2_PROXY_CLIENT_ID}"
  client_secret: "${OAUTH2_PROXY_CLIENT_SECRET}"
  cookie_secret: "${OAUTH2_PROXY_COOKIE_SECRET}"