# Géré par Set-OPS (rôle serveur_oauth2_proxy). Ne pas éditer à la main.
http_address = "{{ serveur_oauth2_proxy_ecoute }}"
reverse_proxy = true

provider = "oidc"
oidc_issuer_url = "{{ serveur_oauth2_proxy_issuer }}"
client_id = "{{ serveur_oauth2_proxy_client_id }}"
client_secret = "{{ serveur_oauth2_proxy_client_secret }}"
redirect_url = "{{ serveur_oauth2_proxy_redirect_url }}"
provider_ca_files = ["{{ serveur_oauth2_proxy_ca_bundle }}"]

upstreams = ["{{ serveur_oauth2_proxy_upstream }}"]

email_domains = ["{{ serveur_oauth2_proxy_email_domains }}"]
insecure_oidc_allow_unverified_email = {{ serveur_oauth2_proxy_allow_unverified_email | lower }}
cookie_secret = "{{ serveur_oauth2_proxy_cookie_secret }}"
cookie_secure = true

# TLS terminé à l'edge ; oauth2-proxy voit HTTP mais reverse_proxy=true honore X-Forwarded-Proto.
skip_provider_button = true
set_xauthrequest = true
pass_user_headers = true