Use service-specific oauth2-proxy instances

roles/service/tasks/main.yaml

@@ -44,6 +44,9 @@
 - name: Socat for {{ service_name }}
   ansible.builtin.include_tasks: socat.yaml
   when: service_container_http_port > 0
+  vars:
+    socat_service_name: "{{ service_name }}"
+    socat_target_http_port: "{{ service_container_http_port }}"
 
 - name: Reverse proxy for {{ service_name }}
   ansible.builtin.include_tasks: proxy.yaml

roles/service/tasks/oauth2_proxy.yaml

@@ -0,0 +1,36 @@
+---
+- name: OAuth2 Proxy container for {{ service_name }}
+  ansible.builtin.import_role:
+    name: container
+  vars:
+    container_name: "{{ service_name }}-oauth2-proxy"
+    container_image: "quay.io/oauth2-proxy/oauth2-proxy:latest-alpine"
+    container_command:
+      - --client-secret-file
+      - /run/secrets/client-secret
+      - --cookie-secret-file
+      - /run/secrets/cookie-secret
+    container_networks:
+      - "{{ service_name }}-oauth2-proxy"
+    container_secrets:
+      - name: "{{ service_name }}-oauth2-proxy-cookie-secret"
+        length: 32
+        target: cookie-secret
+      - name: "{{ service_name }}-oauth2-proxy-client-secret"
+        value: "{{ service_oauth2_proxy_client_secret }}"
+        target: client-secret
+    container_env:
+      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
+      OAUTH2_PROXY_PROVIDER: oidc
+      OAUTH2_PROXY_OIDC_ISSUER_URL: "{{ service_oauth2_proxy_issuer_url }}"
+      OAUTH2_PROXY_CLIENT_ID: "{{ service_oauth2_proxy_client_id }}"
+      OAUTH2_PROXY_CODE_CHALLENGE_METHOD: S256
+      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+      OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+    container_auto_update: "{{ service_auto_update }}"
+
+- name: Socat for OAuth2 Proxy for {{ service_name }}
+  ansible.builtin.import_tasks: socat.yaml
+  vars:
+    socat_service_name: "{{ service_name }}-oauth2-proxy"
+    socat_target_http_port: 4180

roles/service/tasks/proxy.yaml

@@ -1,4 +1,8 @@
 ---
+- name: OAuth2 proxy for {{ service_name }}
+  ansible.builtin.include_tasks: oauth2_proxy.yaml
+  when: _service_oauth2_proxy
+
 - name: Reverse proxy for {{ service_name }}
   ansible.builtin.import_role:
     name: uumas.general.vhost

roles/service/tasks/socat.yaml

@@ -1,25 +1,25 @@
 ---
-- name: Socat socket for {{ service_name }}
+- name: Socat socket for {{ socat_service_name }}
   ansible.builtin.template:
     src: socat.socket.j2
-    dest: /etc/systemd/system/{{ service_name }}-socat.socket
+    dest: /etc/systemd/system/{{ socat_service_name }}-socat.socket
     mode: "0644"
-  notify: Restart socat socket for {{ service_name }}
+  notify: Restart socat socket for {{ socat_service_name }}
 
-- name: Socat container for {{ service_name }}
+- name: Socat container for {{ socat_service_name }}
   ansible.builtin.import_role:
     name: container
   vars:
-    container_name: "{{ service_name }}-socat"
+    container_name: "{{ socat_service_name }}-socat"
     container_image: "docker.io/alpine/socat:latest"
     container_command:
       - "ACCEPT-FD:3,fork"
-      - "TCP:{{ service_name }}:{{ service_container_http_port }}"
+      - "TCP:{{ socat_service_name }}:{{ socat_target_http_port }}"
     container_user: nobody
     container_networks:
-      - "{{ service_name }}"
+      - "{{ socat_service_name }}"
     container_requires:
-      - "{{ service_name }}-socat.socket"
-      - "{{ service_name }}.service"
+      - "{{ socat_service_name }}-socat.socket"
+      - "{{ socat_service_name }}.service"
     container_auto_start: false
     container_auto_update: "{{ service_auto_update }}"