Spec:
  Oidc:
    Access Token Enable:   true
    Auth Endpoint:         https://keycloak.example.com/realms/master/protocol/openid-connect/auth
    Client ID:             nginx-plus
    Client Secret:         oidc-secret
    End Session Endpoint:  https://keycloak.example.com/realms/master/protocol/openid-connect/logout
    Jwks URI:              http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/certs
    Redirect URI:          /_test
    Scope:                 openid+profile+email
    Token Endpoint:        http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/token
Status:
  Message:  Policy default/oidc-policy was added or updated
  Reason:   AddedOrUpdated
  State:    Valid

server {
    listen 80;
    listen [::]:80;

    server_name webapp.example.com;
    status_zone webapp.example.com;
    set $resource_type "virtualserver";
    set $resource_name "webapp";
    set $resource_namespace "default";
    include oidc/oidc.conf;

    set $oidc_pkce_enable 0;
    set $oidc_logout_redirect "/_logout";
    set $oidc_hmac_key "webapp";
    set $zone_sync_leeway 200;

    set $oidc_authz_endpoint "https://keycloak.example.com/realms/master/protocol/openid-connect/auth";
    set $oidc_authz_extra_args "";
    set $oidc_token_endpoint "http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/token";
    set $oidc_end_session_endpoint "https://keycloak.example.com/realms/master/protocol/openid-connect/logout";
    set $oidc_jwt_keyfile "http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/certs";
    set $oidc_scopes "openid+profile+email";
    set $oidc_client "nginx-plus";
    set $oidc_client_secret "<SECRET>";
    set $redir_location "/_test";
    # Custom OIDC redirect location based on policy redirectURI
    location = /_test {
        status_zone "OIDC code exchange";
        js_content oidc.codeExchange;
        error_page 500 502 504 @oidc_error;
    }
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl_certificate $secret_dir_path/default-tls-secret;
    ssl_certificate_key $secret_dir_path/default-tls-secret;
    if ($scheme = 'http') {
        return 301 https://$host$request_uri;
    }

    server_tokens "on";

    location / {
        set $service "webapp-svc";
        status_zone "webapp-svc";
        auth_jwt "" token=$session_jwt;
        error_page 401 = @do_oidc_flow;
        auth_jwt_key_request /_jwks_uri;proxy_set_header username $jwt_claim_sub;
        proxy_set_header Authorization "Bearer $access_token";
        set $default_connection_header close;
        proxy_connect_timeout 60s;
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
        client_max_body_size 1m;

        proxy_buffering on;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $vs_connection_header;
        proxy_pass_request_headers on;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host "$host";
        proxy_pass http://vs_default_webapp_webapp;
        proxy_next_upstream error timeout;
        proxy_next_upstream_timeout 0s;
        proxy_next_upstream_tries 0;
    }
  }