{{- if and .Values.oauth2Proxy.enabled ((.Values.auditProxy).enabled) }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-audit-proxy-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audit-proxy
    app.kubernetes.io/instance: {{ .Release.Name }}
data:
  nginx.conf: |
    worker_processes 2;
    error_log /dev/stderr warn;
    events { worker_connections 1024; }
    http {
      log_format audit '$remote_addr - $http_x_forwarded_email [$time_local] '
                       '"$request" $status $body_bytes_sent rt=$request_time';
      access_log /dev/stdout audit;
      server {
        listen 8080;
        client_max_body_size    64m;
        proxy_read_timeout      600s;
        proxy_send_timeout      600s;
        proxy_connect_timeout   10s;
        proxy_buffering         off;
        location / {
          set $user_email $http_x_forwarded_email;
          proxy_set_header Host $host;
          proxy_set_header X-ClickHouse-Setting-log_comment $user_email;
          proxy_set_header Authorization "";
          proxy_pass_request_headers on;
          if ($request_method = POST) {
            set $args $args&log_comment=$user_email;
          }
          proxy_pass http://{{ .Release.Name }}-clickhouse:8123;
        }
        location /healthz {
          return 200 'ok';
          add_header Content-Type text/plain;
        }
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-audit-proxy
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audit-proxy
    app.kubernetes.io/instance: {{ .Release.Name }}
spec:
  replicas: {{ (.Values.auditProxy).replicas | default 2 }}
  selector:
    matchLabels:
      app.kubernetes.io/name: audit-proxy
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: audit-proxy
        app.kubernetes.io/instance: {{ .Release.Name }}
      annotations:
        checksum/config: {{ .Values.auditProxy | toJson | sha256sum }}
    spec:
      {{- with (.Values.auditProxy).tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: nginx
          image: {{ (.Values.auditProxy).image | default "nginx:1.27-alpine" }}
          ports:
            - name: http
              containerPort: 8080
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 2
            periodSeconds: 5
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 128Mi
      volumes:
        - name: config
          configMap:
            name: {{ .Release.Name }}-audit-proxy-config
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-audit-proxy
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audit-proxy
    app.kubernetes.io/instance: {{ .Release.Name }}
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: audit-proxy
    app.kubernetes.io/instance: {{ .Release.Name }}
  ports:
    - name: http
      port: 8123
      targetPort: 8080
{{- end }}