{% if lookup('sso', application_id, 'is_proxy_gated') %}
  sso-proxy:
    {{ lookup('container_image', 'web-app-keycloak', 'sso_proxy') }}
    {{ lookup('compose_restart') }}
    command: --config /oauth2-proxy.cfg
    {{ lookup('compose_only', 'container_name', ((application_id | get_entity_name) ~ '-sso-proxy')) }}
    hostname: sso-proxy
    labels:
      infinito.sso-proxy.config-sha256: "{{ lookup('template', lookup('path_absolute', 'roles/web-app-keycloak/templates/sso_proxy/oauth2-proxy-keycloak.cfg.j2'), template_vars={'sso_proxy_application_id': application_id}) | hash('sha256') }}"
    ports:
      # nocheck: compose-ports-must-use-container-ports  the published port belongs to the consuming role's own entity and the container port to web-app-keycloak's sso_proxy, so the mapping spans two application_ids and no single container_ports call can read both
      - {{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.' ~ (application_id | get_entity_name) ~ '.ports.local.sso') }}:{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.ports.internal.http') }}/tcp
    volumes:
      - "{{ lookup('container', application_id, 'directories.volumes') }}{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file') }}:/oauth2-proxy.cfg"
{% if (TLS_MODE | lower) == 'self_signed' and OIDC.CLIENT.ISSUER_URL.startswith('https') %}
      - "{{ CA_TRUST.cert_host }}:{{ CA_TRUST.cert_container }}:ro"
{% endif %}
{% if DEPLOYMENT_MODE == 'swarm' %}
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}
    deploy:
      placement:
        constraints:
          - node.role == manager
{% endif %}
    {{ lookup('container_extra_hosts', extra_hosts=(
         [] if lookup('domain', 'web-app-keycloak').endswith('.onion')
         else [lookup('domain', 'web-app-keycloak') ~ ':host-gateway']
       )) | indent(4) }}
    # nocheck: container-healthcheck-literal  per-consumer sidecar partial rendered for the consuming role's application_id, so the declaration has no single meta/services.yml to live in
    healthcheck:
      test: ["CMD", "/bin/oauth2-proxy", "--version"]
      interval: 2m
      timeout: 5s
      retries: 1
      start_period: 10m
      start_interval: 5s
{% endif %}