home-docker/adhoc-config/oauth2-proxy.yaml

---
# OAuth2 Proxy configured to use Pocket ID as OIDC provider
# This acts as the authentication middleware between NGINX Ingress and Pocket ID
apiVersion: v1
kind: Secret
metadata:
  name: pocket-id-oauth-proxy-secrets
  namespace: nginx-ingress
type: Opaque
stringData:
  # Generate with: openssl rand -base64 32 | head -c 32 | base64
  cookie-secret: "TDhNb1p1ZGpYem4xL2ZiV0E2V1pacXYwTS8rbzZWazY="
  # Get these from Pocket ID OIDC client configuration
  client-id: "4119945b-29db-40fa-bafe-7698ae8b1342"
  client-secret: "pKiKmd5v0w9h0fMNvwjS7poycSBz8c3t"

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: pocket-id-oauth-proxy-config
  namespace: nginx-ingress
data:
  oauth2_proxy.cfg: |
    # OIDC Provider Configuration (Pocket ID)
    provider = "oidc"
    oidc_issuer_url = "https://pass.junv.cc"

    # Client Configuration
    client_id = "YOUR-POCKET-ID-CLIENT-ID"
    client_secret = "YOUR-POCKET-ID-CLIENT-SECRET"

    # Cookie Configuration
    cookie_name = "_oauth2_proxy"
    cookie_secret = "CHANGE-ME-GENERATE-NEW-SECRET"
    cookie_secure = true
    cookie_httponly = true
    cookie_domains = [".junv.cc"]
    cookie_expire = "168h"
    cookie_refresh = "72h"

    # Email Configuration
    email_domains = ["*"]

    # Whitelist domains for redirects
    whitelist_domains = [".junv.cc"]

    # Upstream Configuration
    upstreams = ["static://200"]

    # Server Configuration
    http_address = "0.0.0.0:4180"
    reverse_proxy = true

    # Header Configuration
    set_xauthrequest = true
    pass_access_token = true
    pass_authorization_header = true

    # Redirect Configuration
    redirect_url = "https://pass.junv.cc/oauth2/callback"

    # Logging
    request_logging = true
    auth_logging = true

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pocket-id-oauth-proxy
  namespace: nginx-ingress
  labels:
    app: pocket-id-oauth-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pocket-id-oauth-proxy
  template:
    metadata:
      labels:
        app: pocket-id-oauth-proxy
    spec:
      containers:
      - name: pocket-id-oauth-proxy
        # Updated: v7.6.0 -> v7.15.2 (minor bump within v7.x, low risk)
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
        args:
        - --config=/etc/oauth2-proxy/oauth2_proxy.cfg
        env:
        - name: OAUTH2_PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: pocket-id-oauth-proxy-secrets
              key: client-id
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: pocket-id-oauth-proxy-secrets
              key: client-secret
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: pocket-id-oauth-proxy-secrets
              key: cookie-secret
        ports:
        - containerPort: 4180
          protocol: TCP
          name: http
        volumeMounts:
        - name: config
          mountPath: /etc/oauth2-proxy
        livenessProbe:
          httpGet:
            path: /ping
            port: 4180
          initialDelaySeconds: 10
          timeoutSeconds: 1
        readinessProbe:
          httpGet:
            path: /ping
            port: 4180
          initialDelaySeconds: 10
          timeoutSeconds: 1
        resources:
          limits:
            cpu: "500m"
            memory: "256Mi"
          requests:
            cpu: "100m"
            memory: "128Mi"
      volumes:
      - name: config
        configMap:
          name: pocket-id-oauth-proxy-config

---
apiVersion: v1
kind: Service
metadata:
  name: pocket-id-oauth-proxy
  namespace: nginx-ingress
  labels:
    app: pocket-id-oauth-proxy
spec:
  type: ClusterIP
  ports:
  - port: 4180
    targetPort: 4180
    protocol: TCP
    name: http
  selector:
    app: pocket-id-oauth-proxy

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pocket-id-oauth-proxy-ingress
  namespace: nginx-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - pass.junv.cc
    secretName: pocket-id-oauth-proxy-tls
  rules:
  - host: pass.junv.cc
    http:
      paths:
      - path: /oauth2
        pathType: Prefix
        backend:
          service:
            name: pocket-id-oauth-proxy
            port:
              number: 4180