# Local oauth2-proxy for the Hub UI — the hosted auth sidecar (same binary,
# same version as Service.ts deploys) plus a loopback forward: Zitadel routes
# every request by Host header, so the ONE issuer URL (http://localhost:8080)
# must be reachable inside this container too. Public images only — no
# registry auth needed.
FROM quay.io/oauth2-proxy/oauth2-proxy:v7.7.1 AS proxy
FROM alpine:3.21
RUN apk add --no-cache socat ca-certificates
COPY --from=proxy /bin/oauth2-proxy /bin/oauth2-proxy
ENTRYPOINT ["/bin/sh", "-c", "socat TCP-LISTEN:8080,bind=127.0.0.1,fork,reuseaddr TCP:zitadel:8080 & exec /bin/oauth2-proxy \"$@\"", "--"]