version: "3"
services:
  oauth2-proxy:
    container_name: oauth2-proxy
    hostname: oauth2-proxy
    environment:
      - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
      - LANG=en_US.UTF-8
      - LANGUAGE=en_US:en
      - LC_ALL=en_US.UTF-8
      - TZ=America/Los_Angeles
      - OAUTH2_PROXY_PASS_HOST_HEADER=true
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_UPSTREAMS=static://202
      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
      - OAUTH2_PROXY_REDIRECT_URL=https://auth.mydomain.com/oauth2/callback
      - OAUTH2_PROXY_COOKIE_DOMAINS=.mydomain.com
      - OAUTH2_PROXY_SESSION_COOKIE_MINIMAL=true
      - OAUTH2_PROXY_WHITELIST_DOMAINS=.mydomain.com
      - OAUTH2_PROXY_CLIENT_SECRET_FILE=/run/secrets/oauth_client_secret
      - OAUTH2_PROXY_COOKIE_SECRET=${OAUTH2_PROXY_COOKIE_SECRET}
      - OAUTH2_PROXY_EMAIL_DOMAINS=mydomain.com
      - OAUTH2_PROXY_CLIENT_ID=${OAUTH2_PROXY_CLIENT_ID}
      - OAUTH2_PROXY_PROVIDER_DISPLAY_NAME='your email'
      - OAUTH2_PROXY_HTTP_ADDRESS=http://0.0.0.0:4180
      - OAUTH2_PROXY_PROVIDER=entra-id
      - OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.microsoftonline.com/<tenant-id>/v2.0

    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
    volumes:
      - type: bind
        source: /usr/share/zoneinfo
        target: /usr/share/zoneinfo
        read_only: true

    deploy:
      replicas: 1
    ports:
      - 4180:4180/tcp
    restart: always
    secrets:
      - oauth_client_secret

secrets:
  oauth_client_secret:
    external: true