apiVersion: apps/v1
kind: Deployment
metadata:
  name: foundry-vtt-oauth2-proxy
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: foundry-vtt-oauth2-proxy
  template:
    metadata:
      labels:
        app: foundry-vtt-oauth2-proxy
    spec:
      containers:
      - name: oauth2-proxy
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        args:
          - --provider=oidc
          - --oidc-issuer-url=https://sso.mynest.love/realms/nest
          - --redirect-url=https://foundry.mynest.love/oauth2/callback
          - --email-domain=*
          - --upstream=static://200
          - --http-address=0.0.0.0:4180
          - --pass-authorization-header=true
          - --pass-access-token=true
          - --set-xauthrequest=true
          - --skip-provider-button=true
          - --reverse-proxy=true
          - --cookie-secure=true
          - --cookie-domain=.mynest.love
          - --whitelist-domain=.mynest.love
          - --cookie-name=_oauth2_proxy_foundry
        envFrom:
        - secretRef:
            name: foundry-vtt-oauth2-proxy-secret
        ports:
        - containerPort: 4180