# EXAMPLE ONLY — do not apply as-is.
#
# oauth2-proxy reads its GitHub OAuth credentials and cookie-signing secret from
# this Secret. Populate real values and apply:
#
#   kubectl -n dsh-demo create secret generic oauth2-proxy \
#     --from-literal=client-id='<GitHub OAuth App client ID>' \
#     --from-literal=client-secret='<GitHub OAuth App client secret>' \
#     --from-literal=cookie-secret="$(openssl rand -base64 32)"
#
# The cookie secret must be a strong random value (16/24/32 bytes, base64).
# Generate it with: openssl rand -base64 32
#
# GitHub OAuth App (https://github.com/settings/developers):
#   Homepage URL            https://dsh-demo.example.com
#   Authorization callback  https://dsh-demo.example.com/oauth2/callback
#   (replace dsh-demo.example.com with the actual public FQDN)
#
# NOTE: the cookie secret should NOT be base64-encoded again when passed via
# --from-literal (kubectl stores it as-is and the Secret encodes it for you).
apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy
  namespace: dsh-demo
type: Opaque
stringData:
  client-id: "<github-oauth-app-client-id>"
  client-secret: "<github-oauth-app-client-secret>"
  cookie-secret: "<openssl-rand-base64-32>"