apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "nginx-ldapauth-proxy.fullname" . }}
  labels:
    app: {{ template "nginx-ldapauth-proxy.name" . }}
    chart: {{ template "nginx-ldapauth-proxy.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
data:
  nginx.conf: |-
    worker_processes 10;
    worker_rlimit_nofile 16384;

    events {
        worker_connections 1024;
    }

    http {

        upstream backend-server {
            server {{ .Values.proxy.host}}:{{ .Values.proxy.port }};
        }

{{- if and .Values.proxy.ldapHost .Values.secrets.ldapBindPassword }}
        ldap_server ldapserver {
            url {{ .Values.proxy.protocol }}://{{ .Values.proxy.ldapHost }}:{{ .Values.proxy.ldapPort }}/{{ .Values.proxy.ldapDN }}?uid?sub?(&({{ .Values.proxy.ldapFilter}}));
            binddn "{{ .Values.proxy.ldapBindDN }}";
            binddn_passwd {{ .Values.secrets.ldapBindPassword }};
            group_attribute {{ .Values.proxy.ldapGroup }};
            group_attribute_is_dn on;
        {{- range $require := .Values.proxy.requires }}
            require group {{ $require.filter | quote }};
        {{- end }}
            require valid_user;
            satisfy all;
        }
{{- end }}

        server {

            listen {{ .Values.service.internalPort }};
            server_name ldapauth-proxy;

            error_log /var/log/nginx/error.log debug;
            access_log /var/log/nginx/access.log;

            client_max_body_size 0;

            chunked_transfer_encoding on;

            location / {
{{- if and .Values.proxy.ldapHost .Values.secrets.ldapBindPassword }}
                auth_ldap "{{ .Values.proxy.authName }}";
                auth_ldap_servers ldapserver;
                proxy_pass                       http://backend-server;
                proxy_set_header  Host           $http_host;   # required for docker client's sake
                proxy_set_header  X-Real-IP      $remote_addr; # pass on real client's IP
                proxy_set_header  Authorization  ""; # see https://github.com/dotcloud/docker-registry/issues/170
                proxy_read_timeout               900;
{{- end }}
            }

            location /_ping {
                auth_basic off;
                root   /usr/share/nginx/html;
                stub_status on;
            }
        }

    }
