# Apply: kubectl apply -f manifests/media/jellyfin-header-debug.yaml
# Delete: kubectl delete -f manifests/media/jellyfin-header-debug.yaml
# Description: TEMPORARY diagnostic proxy that transparently forwards to the
# real jellyfin Service while logging auth-related request headers to stdout.
# Used to capture what the Filebar iOS app sends on /Users/AuthenticateByName
# so we can see why Jellyfin 12.0 rejects it. Swap the jellyfin Ingress
# backend to jellyfin-debug-proxy to route traffic through this, capture
# logs, then swap back and delete this file/PR once done -- not meant to
# stay in the cluster long-term.
apiVersion: v1
kind: ConfigMap
metadata:
  name: jellyfin-debug-proxy-conf
  namespace: jellyfin
data:
  default.conf: |
    map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
    }
    log_format jf_debug '$time_iso8601 client=$remote_addr method=$request_method uri="$request_uri" '
                         'status=$status '
                         'user_agent="$http_user_agent" '
                         'authorization="$http_authorization" '
                         'x_emby_authorization="$http_x_emby_authorization" '
                         'x_emby_token="$http_x_emby_token" '
                         'x_mediabrowser_token="$http_x_mediabrowser_token"';
    server {
      listen 8080;
      access_log /dev/stdout jf_debug;
      location / {
        proxy_pass http://jellyfin.jellyfin.svc.cluster.local:80;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 3600s;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jellyfin-debug-proxy
  namespace: jellyfin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jellyfin-debug-proxy
  template:
    metadata:
      labels:
        app: jellyfin-debug-proxy
    spec:
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/conf.d
      volumes:
        - name: conf
          configMap:
            name: jellyfin-debug-proxy-conf
---
apiVersion: v1
kind: Service
metadata:
  name: jellyfin-debug-proxy
  namespace: jellyfin
spec:
  selector:
    app: jellyfin-debug-proxy
  ports:
    - port: 80
      targetPort: 8080