http_address            =   "0.0.0.0:{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.ports.internal.http') }}"
cookie_secret           =   "{{ lookup('config', sso_proxy_application_id, 'secrets.credentials.sso_proxy_cookie_secret') }}"
cookie_secure           =   "{{ lookup('tls', sso_proxy_application_id, 'enabled') | string | lower }}"
{% set _sso_upstream_mode = (compose_mode_force | default('')) or DEPLOYMENT_MODE %}
upstreams               =   "http://{{ ((sso_proxy_application_id | get_entity_name) ~ '_') if _sso_upstream_mode == 'swarm' else '' }}{{ lookup('sso', sso_proxy_application_id, 'oauth2_origin_host') }}:{{ lookup('sso', sso_proxy_application_id, 'oauth2_origin_port') }}"  # nocheck: literal-protocol-lookup  Internal docker upstream is plaintext by design.
{% set _tor_node = lookup('config', 'svc-net-tor', 'services.tor.node', '') %}
{% set _domain_list = lookup('domains', sso_proxy_application_id) | domain_strings %}
{% set _has_onion = _tor_node != '' and (_domain_list | select('search', _tor_node) | list | length > 0) %}
{% set _clearnet_domains = _domain_list | reject('search', '\.onion$') | list %}
{% set _has_clearnet = _clearnet_domains | length > 0 %}
{% if _has_clearnet %}
cookie_domains          =   ["{{ _clearnet_domains | common_dns_suffix }}", "{{ lookup('domain', 'web-app-keycloak') }}"]
{% endif %}
whitelist_domains       =   [{% if _has_clearnet %}".{{ DOMAIN_PRIMARY }}"{% endif %}{% if _has_clearnet and _has_onion %}, {% endif %}{% if _has_onion %}".{{ _tor_node }}"{% endif %}]

client_secret           =   "{{ OIDC.CLIENT.SECRET }}"
client_id               =   "{{ OIDC.CLIENT.ID }}"
redirect_url            =   "{{ lookup('tls', sso_proxy_application_id, 'protocols.web') }}://{{ lookup('domain', sso_proxy_application_id) }}/oauth2/callback"
oidc_issuer_url         =   "{{ OIDC.CLIENT.ISSUER_URL }}"
skip_oidc_discovery     =   true
login_url               =   "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
redeem_url              =   "{{ OIDC.CLIENT.TOKEN_URL }}"
oidc_jwks_url           =   "{{ OIDC.CLIENT.CERTS }}"
provider                =   "oidc"
provider_display_name   =   "{{ OIDC.BUTTON_TEXT }}"
{% if (TLS_MODE | lower) == 'self_signed' and OIDC.CLIENT.ISSUER_URL.startswith('https') %}
provider_ca_files       =   ["{{ CA_TRUST.cert_container }}"]
{% endif %}

{% set allowed_groups_raw = lookup('sso', sso_proxy_application_id, 'oauth2_allowed_groups') %}
{% if allowed_groups_raw %}
scope                   =   "openid email profile {{ RBAC.GROUP.CLAIM }}"
oidc_groups_claim       =   "{{ RBAC.GROUP.CLAIM }}"
allowed_groups          =   {{ allowed_groups_raw | map('regex_replace', '^/*', '/') | list | to_json }}
email_domains           =   ["*"]
{% else %}
email_domains           =   "{{ DOMAIN_PRIMARY }}"
{% endif %}

session_store_type       = "redis"
redis_connection_url     = "{{ lookup('engine', 'redis', sso_proxy_application_id, 'url') }}"

set_xauthrequest         = true
pass_user_headers        = true
pass_access_token        = {{ lookup('sso', sso_proxy_application_id, 'oauth2_pass_access_token') | string | lower }}