{{- $secret := include "clientSecret" . -}}
---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: {{ .Values.oauth2.secretName }}
  namespace: {{ .Release.Namespace }}
data:
  client_id: {{ .Values.oauth2.clientId | b64enc  }}
  client_secret: {{ $secret | b64enc }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Values.oauth2.configName }}
  namespace: {{ .Release.Namespace }}
data:
  oauth2-proxy.cfg: |
    http_address = "0.0.0.0:8080"

    reverse_proxy = true

    ## the OAuth Redirect URL.
    # defaults to the "https://" + requested host header + "/oauth2/callback"
    # redirect_url = "http://pihole.pcloud/oauth2/callback"

    upstreams = [
        "http://pihole-web.{{ .Release.Namespace}}.svc"
    ]

    email_domains = [
        "*"
    ]

    standard_logging = false
    request_logging = false
    auth_logging = false

    pass_basic_auth = true
    pass_user_headers = true
    pass_host_header = true

    ## The OAuth Client ID, Secret
    client_id = "{{ .Values.oauth2.clientId }}"
    client_secret = "{{ $secret }}"

    ## Pass OAuth Access token to upstream via "X-Forwarded-Access-Token"
    pass_access_token = false

    cookie_name = "_oauth2_proxy_pihole"
    cookie_secret = "123456789012345678901234567890--"
    cookie_domains = "pihole.p.{{ .Values.domain }}"
    cookie_expire = "168h"
    cookie_refresh = "100h"
    cookie_secure = true
    cookie_httponly = true

    provider = "oidc"
    oidc_issuer_url = "{{ .Values.hydraPublic }}"
    provider_display_name = "PCloud"
    profile_url = "{{ .Values.profileUrl }}"