service: Support proxy forward auth using OAuth2 Proxy

roles/service/vars/main/general.yaml

@@ -15,7 +15,3 @@ _service_container_wants: >-
         | map(attribute='name')
         | map('regex_replace', '$', '.service')
   }}
-
-_service_replacement_host_header:
-  Host: "{{ service_name }}:{{ service_container_http_port }}"
-_service_proxy_headers: "{{ _service_replacement_host_header if not service_proxy_pass_host_header else {} }}"

roles/service/vars/main/proxy.yaml

@@ -0,0 +1,18 @@
+---
+_service_replacement_host_header:
+  Host: "{{ service_name }}:{{ service_container_http_port }}"
+_service_proxy_headers: "{{ _service_replacement_host_header if not service_proxy_pass_host_header else {} }}"
+
+_service_oauth2_proxy: "{{ service_proxy_auth_type == 'oauth2-proxy' }}"
+_service_oauth2_socket: >-
+  {{ '/run/oauth2-proxy-socat.sock' if _service_oauth2_proxy else '' }}
+_service_oauth2_proxy_location:
+  path: /oauth2/*
+  proxy_target_socket: "{{ _service_oauth2_socket }}"
+  proxy_auth_socket: ""
+
+_service_vhost_locations: >-
+  {{
+    service_vhost_locations +
+      ([_service_oauth2_proxy_location] if _service_oauth2_proxy else [])
+  }}