# Copy to /opt/casan-control-panel/oauth2-proxy.env on the host.
# Values below are placeholders; do not commit real secrets.

OAUTH2_PROXY_PROVIDER=oidc
OAUTH2_PROXY_OIDC_ISSUER_URL=https://idp.example.com/realms/casan
OAUTH2_PROXY_CLIENT_ID=casan-control-panel
OAUTH2_PROXY_CLIENT_SECRET=replace-with-secret
OAUTH2_PROXY_COOKIE_SECRET=replace-with-32-byte-base64-secret
OAUTH2_PROXY_COOKIE_SECURE=true
OAUTH2_PROXY_EMAIL_DOMAINS=*
OAUTH2_PROXY_SCOPE=openid email profile groups
OAUTH2_PROXY_OIDC_GROUPS_CLAIM=groups
OAUTH2_PROXY_REDIRECT_URL=https://control-panel.example.com/oauth2/callback

# Required so nginx can pass verified identity to the API.
OAUTH2_PROXY_SET_XAUTHREQUEST=true
OAUTH2_PROXY_PASS_ACCESS_TOKEN=false
OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=false

# Recommended: restrict to groups that map through rbac-check.py map-claim:
# casan-org-admin, casan-project-admin, casan-approver, casan-operator,
# casan-viewer, casan-auditor.
# OAUTH2_PROXY_ALLOWED_GROUPS=casan-org-admin,casan-project-admin,casan-approver,casan-operator,casan-viewer,casan-auditor