apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-grafana-proxy-nginx
  namespace: monitoring
data:
  nginx.conf: |
    worker_processes  1;
    events { worker_connections  1024; }
    http {
      map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
      }

      server {
        listen 80;
        server_name _;

        # Strip any inbound auth headers — Grafana auth.google handles
        # Google users directly. Kerberos auth_request (X-WEBAUTH-USER
        # injection) re-enabled once knoe-auth /auth/verify is ready.
        proxy_set_header X-WEBAUTH-USER "";
        proxy_set_header X-Knoe-Groups "";

        location / {
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection $connection_upgrade;
          proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
        }
      }
    }