apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy-google-oidc
  namespace: supabase
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: knoe-installer
# Google OAuth 2.0 client credentials + cookie secret for the oauth2-proxy
# gating Supabase Studio at db.prole.org on the k3s homelab cluster.
# Applied by etc/init_oauth2_proxy_prole.sh via envsubst from
# etc/secrets/oauth2-proxy-{client-id,client-secret,cookie-secret}-prole.
#
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
# (in the prole.org GCP project — separate from the knoey.com project)
# - Application type: Web application
# - Name: prole.org Studio
# - Authorized JavaScript origins: https://db.prole.org
# - Authorized redirect URIs: https://db.prole.org/oauth2/callback
# - OAuth consent screen: Internal (prole.org Workspace only)
# - Scopes: openid, email, profile
#
# cookie_secret: must be 32 bytes. Generate with:
#   openssl rand -base64 32
#
# Why a separate client from prole.org Grafana: independent rotation surface.
# Companion to grafana-google-oidc-secret-prole.example.yaml.
type: Opaque
stringData:
  client_id: "${OAUTH2_PROXY_CLIENT_ID}"
  client_secret: "${OAUTH2_PROXY_CLIENT_SECRET}"
  cookie_secret: "${OAUTH2_PROXY_COOKIE_SECRET}"