# OAuth2-Proxy for Portainer container management UI
# Protects container orchestration interface with Authentik OIDC

apiVersion: v1
kind: ServiceAccount
metadata:
  name: oauth2-proxy
  namespace: dashboard

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: oauth2-proxy-portainer
  namespace: dashboard
spec:
  replicas: 1
  selector:
    matchLabels:
      app: oauth2-proxy-portainer
  template:
    metadata:
      labels:
        app: oauth2-proxy-portainer
      annotations:
        secret.reloader.stakater.com/reload: "portainer-oidc"
    spec:
      serviceAccountName: oauth2-proxy
      containers:
      - name: oauth2-proxy
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 4180
          protocol: TCP
        env:
        - name: OAUTH2_PROXY_PROVIDER
          value: "oidc"
        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
          value: "https://authentik.riotpiao.homelab.com/application/o/portainer/"
        - name: OAUTH2_PROXY_CLIENT_ID
          value: "portainer"
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: portainer-oidc
              key: clientSecret
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: portainer-oidc
              key: cookieSecret
        - name: OAUTH2_PROXY_REDIRECT_URL
          value: "https://portainer.riotpiao.homelab.com/oauth2/callback"
        - name: OAUTH2_PROXY_UPSTREAM
          value: "http://portainer:9000"
        - name: OAUTH2_PROXY_COOKIE_SECURE
          value: "true"
        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
          value: "true"
        - name: OAUTH2_PROXY_COOKIE_SAMESITE
          value: "Lax"
        - name: OAUTH2_PROXY_EMAIL_DOMAIN
          value: "*"
        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
          value: "^/health|^/api/status"
        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
          value: "true"
        - name: OAUTH2_PROXY_REVERSE_PROXY
          value: "true"
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        livenessProbe:
          httpGet:
            path: /ping
            port: http
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ping
            port: http
          initialDelaySeconds: 5
          periodSeconds: 5

---
apiVersion: v1
kind: Service
metadata:
  name: oauth2-proxy-portainer
  namespace: dashboard
spec:
  type: ClusterIP
  ports:
  - port: 4180
    targetPort: http
    protocol: TCP
    name: http
  selector:
    app: oauth2-proxy-portainer