{{- if .Values.deployment.oauth2proxy.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "supabase.oauth2proxy.fullname" . }}
  labels:
    {{- include "supabase.labels" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "supabase.oauth2proxy.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "supabase.oauth2proxy.selectorLabels" . | nindent 8 }}
    spec:
      containers:
        - name: oauth2-proxy
          image: "{{ .Values.deployment.oauth2proxy.image.repository }}:{{ .Values.deployment.oauth2proxy.image.tag }}"
          imagePullPolicy: IfNotPresent
          args:
            - --provider=oidc
            - --oidc-issuer-url=https://accounts.google.com
            - --email-domain={{ .Values.deployment.oauth2proxy.emailDomain | default "knoey.com" }}
            - --upstream=http://{{ include "supabase.studio.fullname" . }}:{{ .Values.service.studio.port }}
            - --http-address=0.0.0.0:{{ .Values.deployment.oauth2proxy.port }}
            - --redirect-url={{ .Values.deployment.oauth2proxy.redirectUrl }}
            - --cookie-secure=true
            - --skip-provider-button=false
            - --silence-ping-logging=true
          env:
            - name: OAUTH2_PROXY_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  {{- if .Values.secret.oauth2proxy.secretRef }}
                  name: {{ .Values.secret.oauth2proxy.secretRef }}
                  key: {{ .Values.secret.oauth2proxy.secretRefKey.clientId | default "clientId" }}
                  {{- else }}
                  name: {{ include "supabase.secret.oauth2proxy" . }}
                  key: clientId
                  {{- end }}
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  {{- if .Values.secret.oauth2proxy.secretRef }}
                  name: {{ .Values.secret.oauth2proxy.secretRef }}
                  key: {{ .Values.secret.oauth2proxy.secretRefKey.clientSecret | default "clientSecret" }}
                  {{- else }}
                  name: {{ include "supabase.secret.oauth2proxy" . }}
                  key: clientSecret
                  {{- end }}
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  {{- if .Values.secret.oauth2proxy.secretRef }}
                  name: {{ .Values.secret.oauth2proxy.secretRef }}
                  key: {{ .Values.secret.oauth2proxy.secretRefKey.cookieSecret | default "cookieSecret" }}
                  {{- else }}
                  name: {{ include "supabase.secret.oauth2proxy" . }}
                  key: cookieSecret
                  {{- end }}
          ports:
            - name: http
              containerPort: {{ .Values.deployment.oauth2proxy.port }}
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /ping
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /ping
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
      {{- include "supabase.enforcedGeneralNodeSelector" (dict "nodeSelector" dict "enforceGeneralNodeRole" .Values.scheduling.enforceGeneralNodeRole) | nindent 6 }}
      {{- include "supabase.enforcedGeneralAffinity" (dict "affinity" dict "enforceGeneralNodeRole" .Values.scheduling.enforceGeneralNodeRole) | nindent 6 }}
{{- end }}