# The proxy needs its own ingress path. nginx auth_request also guards
# /oauth2/start and /oauth2/callback, which would loop: the login entry point
# would itself require a login. A longer path match sends /oauth2 to the proxy
# directly, and the prefix rule on the gotify ingress handles everything else.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gotify-oauth2
  namespace: notifications
spec:
  ingressClassName: nginx
  rules:
    - host: gotify.riotpiao.com
      http:
        paths:
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: gotify-oauth2-proxy
                port:
                  number: 4180