{{- if .Values.middleware.enabled }}
{{- $portals := include "tfa.portals" . | fromYamlArray -}}
{{- range $portals }}
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  # Referenced by apps as <namespace>-<name>@kubernetescrd. Renaming one detaches
  # protection from every ingress that names it.
  name: {{ .middlewareName }}
  labels:
    {{- include "tfa.labels" $ | nindent 4 }}
spec:
  forwardAuth:
    # The path selects the portal, and therefore which OAuth2 client — which is
    # how access is separated between domains.
    address: "http://{{ $.Release.Name }}.{{ $.Release.Namespace }}.svc.cluster.local/portals/{{ .name }}"
    trustForwardHeader: {{ $.Values.middleware.trustForwardHeader }}
    {{- with $.Values.middleware.authResponseHeaders }}
    authResponseHeaders:
      {{- toYaml . | nindent 6 }}
    {{- end }}
{{- end }}
{{- end }}