flagSet.String("http-address","127.0.0.1:4180","[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients")
flagSet.String("https-address",":443","<addr>:<port> to listen on for HTTPS clients")
flagSet.Bool("reverse-proxy",false,"are we running behind a reverse proxy, controls whether headers like X-Real-Ip are accepted")
flagSet.String("real-client-ip-header","X-Real-IP","Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)")
flagSet.StringSlice("trusted-ip",[]string{},"list of IPs or CIDR ranges to allow to bypass authentication. WARNING: trusting by IP has inherent security flaws, read the configuration documentation for more information.")
flagSet.StringSlice("skip-auth-regex",[]string{},"(DEPRECATED for --skip-auth-route) bypass authentication for requests path's that match (may be given multiple times)")
flagSet.StringSlice("skip-auth-route",[]string{},"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods")
flagSet.Bool("skip-provider-button",false,"will skip sign-in-page to directly reach the next step: oauth/start")
flagSet.Bool("skip-auth-preflight",false,"will skip authentication for OPTIONS requests")
flagSet.Bool("ssl-insecure-skip-verify",false,"skip validation of certificates presented when using HTTPS providers")
flagSet.Bool("skip-jwt-bearer-tokens",false,"will skip requests that have verified JWT bearer tokens (default false)")
flagSet.StringSlice("extra-jwt-issuers",[]string{},"if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
flagSet.StringSlice("email-domain",[]string{},"authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
flagSet.StringSlice("whitelist-domain",[]string{},"allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")
flagSet.String("keycloak-group","","restrict login to members of this group.")
flagSet.String("azure-tenant","common","go to a tenant-specific or common (tenant-independent) endpoint.")
flagSet.String("bitbucket-team","","restrict logins to members of this team")
flagSet.String("bitbucket-repository","","restrict logins to user with access to this repository")
flagSet.String("github-org","","restrict logins to members of this organisation")
flagSet.String("github-team","","restrict logins to members of this team")
flagSet.String("github-repo","","restrict logins to collaborators of this repository")
flagSet.String("github-token","","the token to use when verifying repository collaborators (must have push access to the repository)")
flagSet.StringSlice("github-user",[]string{},"allow users with these usernames to login even if they do not belong to the specified org and team or collaborators (may be given multiple times)")
flagSet.String("htpasswd-file","","additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -B\" for bcrypt encryption")
flagSet.String("redis-password","","Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url`")
flagSet.Bool("redis-use-sentinel",false,"Connect to redis via sentinels. Must set --redis-sentinel-master-name and --redis-sentinel-connection-urls to use this feature")
flagSet.String("redis-sentinel-password","","Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password`")
flagSet.String("redis-sentinel-master-name","","Redis sentinel master name. Used in conjunction with --redis-use-sentinel")
flagSet.String("redis-ca-path","","Redis custom CA path")
flagSet.Bool("redis-insecure-skip-tls-verify",false,"Use insecure TLS connection to redis")
flagSet.StringSlice("redis-sentinel-connection-urls",[]string{},"List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
flagSet.Bool("redis-use-cluster",false,"Connect to redis cluster. Must set --redis-cluster-connection-urls to use this feature")
flagSet.StringSlice("redis-cluster-connection-urls",[]string{},"List of Redis cluster connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster")
flagSet.StringSlice("provider-ca-file",[]string{},"One or more paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead.")
flagSet.String("jwt-key","","private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")
flagSet.String("jwt-key-file","","path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov")
flagSet.String("pubjwk-url","","JWK pubkey access endpoint: required by login.gov")
