---

- set_fact:
    api_proxy_auth_services: "{{ services.values() | selectattr('public_endpoints', 'defined') | map(attribute='public_endpoints') | flatten | selectattr('enable_api_proxy', 'defined') | selectattr('enable_api_proxy') | map(attribute='auth_service') }}"

- name: Configure api-proxy auth services
  copy:
    dest: "/etc/auth-server/services.d/api-proxy.yml"
    content: |
      {% for s in api_proxy_auth_services %}
      {{ s }}:
        backends:
          - backend: file
            params:
              src: users.yml
              static_groups: [admins]
        enforce_2fa: true
        rate_limits:
          - ip_ratelimit
          - failed_login_blacklist
          - anti_bruteforce_blacklist
      {% endfor %}
  when: "api_proxy_auth_services"

