From 6d7897e2a6a85c4294b943ab8a1773c0670c270c Mon Sep 17 00:00:00 2001
From: pierre <pierre@geeraert.eu>
Date: Tue, 8 Jul 2025 00:14:56 +0100
Subject: [PATCH] work to add oauth

---
 terraform/variables.auto.tfvars | 91 ++++++++++++++++++++++++++++++---
 1 file changed, 84 insertions(+), 7 deletions(-)

diff --git a/terraform/variables.auto.tfvars b/terraform/variables.auto.tfvars
index 0a066a6..af907b6 100644
--- a/terraform/variables.auto.tfvars
+++ b/terraform/variables.auto.tfvars
@@ -11,14 +11,49 @@ nginx_sites = {
   }
 
   django = {
-    service     = "webserver.django-python.svc:8000"
+    #service     = "webserver.django-python.svc:8000"
+    service     = "django-svc.django:8000"
     proxy_cache = true
     http2_bool  = true
   }
   echo = {
-    service     = "echo-server.echo-server.svc:80"
+    #    service     = "echo-server.echo-server.svc:80"
+    service     = "echo-svc.echo.svc"
     proxy_cache = true
     http2_bool  = true
+
+    extra-value-location = <<EOT
+      auth_request /oauth2/auth;
+      error_page 401 = @oauth2_signin;
+proxy_set_header X-Auth-Request-Redirect $request_uri;
+                EOT
+
+    extra-value = <<EOT
+      location = /oauth2/auth {
+      internal;
+proxy_pass http://oauthn_backend;
+#        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
+      proxy_pass_request_body off;
+      proxy_set_header Content-Length "";
+      proxy_set_header X-Original-URI $request_uri;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Scheme $scheme;
+    }
+    location @oauth2_signin {
+      return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
+    }
+
+    location /oauth2/ {
+proxy_pass http://oauthn_backend;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Scheme $scheme;
+    proxy_set_header X-Auth-Request-Redirect $request_uri;
+    }
+
+                EOT
+
+
   }
   gitlab = {
     service          = "webserver.gitlab.svc:443"
@@ -32,7 +67,7 @@ client_max_body_size 20m;
     proxy_pass_https = true
   }
   sonarr = {
-    service = "sonarr.servarr.svc"
+    service = "sonarr-svc.servarr.svc:8989"
   }
 
   keycloak = {
@@ -102,17 +137,21 @@ client_max_body_size 20m;
     service = "portainer.portainer.svc"
   }
   prowlarr = {
-    service = "prowlarr.servarr.svc"
+    service = "prowlarr-svc.servarr.svc:9696"
   }
   proxmox = {
     service = "192.168.6.2:8006"
     enabled = false
   }
   qbittorrent = {
-    service = "qbittorrent.servarr.svc:8080"
+    service = "qbittorrent-svc.servarr.svc:8080"
   }
   radarr = {
-    service = "radarr.servarr.svc"
+    service = "radarr-svc.servarr.svc:7878"
+  }
+  recommendarr = {
+    service = "recommendarr-svc.servarr.svc:3000"
+    enabled = false
   }
   reverse = {
     service = "192.168.88.50:8888"
@@ -120,6 +159,7 @@ client_max_body_size 20m;
   }
   sickchill = {
     service = "sickchill.servarr.svc"
+    enabled = false
   }
   transmission = {
     service = "192.168.88.52:31091"
@@ -139,8 +179,14 @@ client_max_body_size 20m;
   }
 
   immich = {
-    service = "immich-server.immich.svc:3001"
+    #service = "immich-server.immich.svc:3001"
+    service = "immich-server.immich.svc:2283"
   }
+  immicht = {
+    service = "immicht-svc.immicht.svc:2283"
+    enabled = false
+  }
+
   netdata = {
     enabled = false
     service = "netdata-agent.netdata.svc:19999"
@@ -151,6 +197,7 @@ client_max_body_size 20m;
     listen_port_80_bool    = true
     service                = "screeps-svc.screeps.svc:21025"
   }
+
   stirling = {
     enabled = false
     service = "stirling-svc.stirling.svc:8080"
@@ -313,4 +360,34 @@ proxy_set_header Connection "upgrade";
 
                 EOT
   }
+  wikijs = {
+    #enabled = false
+    service = "wikijs-svc.wikijs.svc:3000"
+  }
+
+  keycloak = {
+    #enabled = false
+    service     = "keycloak-svc.keycloak.svc:8080"
+    extra-value = <<EOT
+
+        set_real_ip_from 0.0.0.0/0;
+        real_ip_header X-Real-IP;
+        real_ip_recursive on;
+                        EOT
+  }
+  oauthn = {
+    #enabled = false
+    service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"
+
+   # extra-value = <<EOT
+   # location /oauth2/ {
+#	proxy_pass http://oauthn_backend;
+#	proxy_set_header Host $host;
+#	proxy_set_header X-Real-IP $remote_addr;
+#	proxy_set_header X-Scheme $scheme;
+ #   }
+  #              EOT
+
+
+  }
 }