# oauth2-proxy Konfiguration
OAUTH2_PROXY_PROVIDER=oidc
OAUTH2_PROXY_OIDC_ISSUER_URL=https://iam.ljh31.de/realms/family
OAUTH2_PROXY_CLIENT_ID=auth-proxy
OAUTH2_PROXY_CLIENT_SECRET=<keycloak_client_secret>
OAUTH2_PROXY_REDIRECT_URL=https://auth-proxy.ljh31.de/oauth2/callback

# Cookie
OAUTH2_PROXY_COOKIE_SECRET=<openssl rand -hex 16>
OAUTH2_PROXY_COOKIE_NAME=_oauth2_proxy
OAUTH2_PROXY_COOKIE_EXPIRE=2h
OAUTH2_PROXY_COOKIE_SECURE=true
OAUTH2_PROXY_COOKIE_SAMESITE=lax

# User-Einschränkung (nur ljH31.de-Domains)
OAUTH2_PROXY_EMAIL_DOMAINS=ljh31.de

# Headers für die Backend-App
OAUTH2_PROXY_SET_XAUTHREQUEST=true
OAUTH2_PROXY_PASS_ACCESS_TOKEN=true

# HTTP-Listen-Adresse (0.0.0.0 für Container-Zugriff)
OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180

# Logging
OAUTH2_PROXY_LOG_LEVEL=info
OAUTH2_PROXY_LOG_FORMAT=json