---
- name: OAuth2 Proxy container for {{ service_name }}
  ansible.builtin.import_role:
    name: container
  vars:
    container_name: "{{ service_name }}-oauth2-proxy"
    container_image: "quay.io/oauth2-proxy/oauth2-proxy:latest-alpine"
    container_command:
      - --client-secret-file
      - /run/secrets/client-secret
      - --cookie-secret-file
      - /run/secrets/cookie-secret
    container_networks:
      - "{{ service_name }}-oauth2-proxy"
    container_secrets:
      - name: "{{ service_name }}-oauth2-proxy-cookie-secret"
        length: 32
        target: cookie-secret
      - name: "{{ service_name }}-oauth2-proxy-client-secret"
        value: "{{ service_oauth2_proxy_client_secret }}"
        target: client-secret
    container_env:
      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
      OAUTH2_PROXY_PROVIDER: oidc
      OAUTH2_PROXY_OIDC_ISSUER_URL: "{{ service_oauth2_proxy_issuer_url }}"
      OAUTH2_PROXY_CLIENT_ID: "{{ service_oauth2_proxy_client_id }}"
      OAUTH2_PROXY_CODE_CHALLENGE_METHOD: S256
      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
      OAUTH2_PROXY_EMAIL_DOMAINS: "*"
    container_auto_update: "{{ service_auto_update }}"

- name: Socat for OAuth2 Proxy for {{ service_name }}
  ansible.builtin.import_tasks: socat.yaml
  vars:
    socat_service_name: "{{ service_name }}-oauth2-proxy"
    socat_target_http_port: 4180
    socat_container_ip: ""