# EXAMPLE ONLY — do not apply as-is.
#
# oauth2-proxy reads its GitHub OAuth credentials and cookie-signing secret from
# this Secret. Populate real values and apply:
#
#   kubectl -n dsh-demo create secret generic oauth2-proxy \
#     --from-literal=client-id='<GitHub OAuth App client ID>' \
#     --from-literal=client-secret='<GitHub OAuth App client secret>' \
#     --from-literal=cookie-secret="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
#
# The cookie secret must decode (base64) to exactly 16, 24, or 32 bytes.
# oauth2-proxy base64-decodes it, so it must be URL-safe, unpadded base64.
# Generate it with either of:
#
#   python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
#   openssl rand -base64 32 | tr -- '+/' '-_' | tr -d '='
#
# Do NOT use plain `openssl rand -base64 32`: that yields 44 characters of
# standard base64 (with "=" and possibly "+"/"/"), which oauth2-proxy cannot
# decode and therefore treats as 44 raw bytes, failing with "cookie_secret must
# be 16, 24, or 32 bytes ... but is 44 bytes".
#
# GitHub OAuth App (https://github.com/settings/developers):
#   Homepage URL            https://dsh-demo.example.com
#   Authorization callback  https://dsh-demo.example.com/oauth2/callback
#   (replace dsh-demo.example.com with the actual public FQDN)
#
# NOTE: pass the base64 value as-is via --from-literal (kubectl stores the
# literal; it does not base64-encode it a second time).
apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy
  namespace: dsh-demo
type: Opaque
stringData:
  client-id: "<github-oauth-app-client-id>"
  client-secret: "<github-oauth-app-client-secret>"
  cookie-secret: "<urlsafe-unpadded-base64-of-32-random-bytes>"