# oauth2-proxy in front of Gotify. Gotify has no OIDC support of its own, so it
# cannot validate a ZITADEL token. This proxy is the front door: nginx asks it
# for an auth decision on every request (auth_request), and it answers from a
# ZITADEL session cookie.
#
# The Gotify REST API keeps its own client-token auth (X-Gotify-Key) and must
# stay reachable without a browser session, or every push sender breaks:
# Forgejo webhooks, the harness, poimen-sender and the ntfy-style relays all post
# to /message. skip-auth-route leaves those paths to Gotify's own token check.
#
# Gotify's own login still exists behind the proxy. ZITADEL decides who may
# reach the service; Gotify decides what that person may do inside it.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gotify-oauth2-proxy
  namespace: notifications
  labels:
    app: gotify-oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gotify-oauth2-proxy
  template:
    metadata:
      labels:
        app: gotify-oauth2-proxy
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: oauth2-proxy
          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
          args:
            - --provider=oidc
            - --oidc-issuer-url=https://zitadel.riotpiao.com
            - --email-domain=*
            - --upstream=static://202
            - --reverse-proxy=true
            - --set-xauthrequest=true
            - --cookie-secure=true
            - --cookie-expire=12h
            - --cookie-refresh=1h
            - --skip-provider-button=true
            - --redirect-url=https://gotify.riotpiao.com/oauth2/callback
            - --http-address=0.0.0.0:4180
            # Browser paths keep SSO. API paths fall through to Gotify's own
            # client-token check, so existing senders and the Android client
            # keep working without a browser session.
            - --skip-auth-route=^/(message|application|client|user|version|stream|health)(/.*)?$
          env:
            - name: OAUTH2_PROXY_CLIENT_ID
              valueFrom:
                secretKeyRef: {name: gotify-oauth2-proxy, key: client-id}
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom:
                secretKeyRef: {name: gotify-oauth2-proxy, key: client-secret}
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom:
                secretKeyRef: {name: gotify-oauth2-proxy, key: cookie-secret}
          ports:
            - name: http
              containerPort: 4180
          readinessProbe:
            httpGet: {path: /ping, port: http}
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet: {path: /ping, port: http}
            initialDelaySeconds: 15
            periodSeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            requests: {cpu: 10m, memory: 32Mi}
            limits: {cpu: 200m, memory: 128Mi}