apiVersion: v1
kind: ConfigMap
metadata:
  name: zitadel-oidc-internal
  namespace: zitadel
  labels:
    app.kubernetes.io/name: zitadel-oidc-internal
    app.kubernetes.io/instance: zitadel
    app.kubernetes.io/component: oidc-internal
data:
  nginx.conf: |
    worker_processes auto;
    error_log /dev/stderr notice;
    pid /tmp/nginx.pid;

    events {
      worker_connections 1024;
    }

    http {
      include /etc/nginx/mime.types;
      default_type application/octet-stream;
      access_log /dev/stdout;
      sendfile on;
      keepalive_timeout 65;
      client_body_temp_path /tmp/client_temp;
      proxy_temp_path /tmp/proxy_temp;
      fastcgi_temp_path /tmp/fastcgi_temp;
      uwsgi_temp_path /tmp/uwsgi_temp;
      scgi_temp_path /tmp/scgi_temp;
      map $ssl_server_name $oidc_certificate {
        default auth.quorate.dev;
      }
      include /etc/nginx/conf.d/*.conf;
    }
  default.conf: |
    server {
      listen 8080;
      listen 8443 ssl;
      server_name auth.quorate.dev;
      client_max_body_size 1m;
      ssl_certificate /run/tls/$oidc_certificate.crt;
      ssl_certificate_key /run/tls/$oidc_certificate.key;
      ssl_protocols TLSv1.2 TLSv1.3;
      proxy_http_version 1.1;
      proxy_set_header Host auth.quorate.dev;
      proxy_set_header X-Forwarded-Host auth.quorate.dev;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header Connection "";
      proxy_connect_timeout 5s;
      proxy_read_timeout 30s;

      location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 'ok';
      }

      location = /oauth/v2/token {
        limit_except POST {
          deny all;
        }
        proxy_pass http://zitadel.zitadel.svc.cluster.local:8080;
      }

      location = /oauth/v2/keys {
        limit_except GET HEAD {
          deny all;
        }
        proxy_pass http://zitadel.zitadel.svc.cluster.local:8080;
      }

      location = /oidc/v1/userinfo {
        limit_except GET HEAD {
          deny all;
        }
        proxy_pass http://zitadel.zitadel.svc.cluster.local:8080;
      }

      location = /.well-known/openid-configuration {
        limit_except GET HEAD {
          deny all;
        }
        proxy_pass http://zitadel.zitadel.svc.cluster.local:8080;
      }

      location / {
        return 404;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: zitadel-oidc-internal
  namespace: zitadel
  labels:
    app.kubernetes.io/name: zitadel-oidc-internal
    app.kubernetes.io/instance: zitadel
    app.kubernetes.io/component: oidc-internal
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: zitadel-oidc-internal
      app.kubernetes.io/instance: zitadel
  template:
    metadata:
      labels:
        app.kubernetes.io/name: zitadel-oidc-internal
        app.kubernetes.io/instance: zitadel
        app.kubernetes.io/component: oidc-internal
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: nginx
          image: cgr.dev/chainguard/nginx@sha256:0b4de0f60ae2295fdc852564d178b5473109baf9fc826fa5eb38a59f930e218e
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
            - name: https
              containerPort: 8443
              protocol: TCP
          volumeMounts:
            - name: nginx-conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: conf-d
              mountPath: /etc/nginx/conf.d
              readOnly: true
            - name: tmp
              mountPath: /tmp
            - name: tls
              mountPath: /run/tls
              readOnly: true
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 1
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 15
      volumes:
        - name: nginx-conf
          configMap:
            name: zitadel-oidc-internal
            items:
              - key: nginx.conf
                path: nginx.conf
        - name: conf-d
          configMap:
            name: zitadel-oidc-internal
            items:
              - key: default.conf
                path: default.conf
        - name: tmp
          emptyDir: {}
        - name: tls
          secret:
            secretName: gateway-relay-tls
            defaultMode: 0440
            items:
              - key: tls.crt
                path: auth.quorate.dev.crt
              - key: tls.key
                path: auth.quorate.dev.key
---
apiVersion: v1
kind: Service
metadata:
  name: zitadel-oidc-internal
  namespace: zitadel
  labels:
    app.kubernetes.io/name: zitadel-oidc-internal
    app.kubernetes.io/instance: zitadel
    app.kubernetes.io/component: oidc-internal
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: zitadel-oidc-internal
    app.kubernetes.io/instance: zitadel
  ports:
    - name: http
      port: 8080
      targetPort: http
      protocol: TCP
    - name: https
      port: 443
      targetPort: https
      protocol: TCP