mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c8c3f96bf9
The Keycloak vhost proxied every path to Keycloak, so the admin console and the admin REST API under /admin/realms answered any client on the internet (observed on auth.veen.world and auth.infinito.nexus), and sys-svc-proxy had no way to limit a path by source address. services.keycloak.admin.allowed_networks now takes the networks the operator declares in the inventory. When the list is non-empty, the vhost gets its own `location ^~ /admin`, rendered through the shared html.conf.j2 like `/`, with one `allow` per entry and `deny all`. The `^~` modifier keeps a regex location from taking an admin path over. The OIDC endpoints under /realms/ and the assets under /resources/ stay public. The role ships the list empty and adds no network of its own, so an inventory that declares nothing renders today's vhost unchanged. kc_admin_networks rejects anything but a list of addresses or CIDR blocks without host bits, so a typo fails the render instead of the nginx reload. The deploy's own admin calls do not cross the vhost: every kcadm.sh login, including web-app-opentalk's and web-app-mattermost's, runs inside the Keycloak container against a loopback URL, and a unit test now pins that. The README names the callers that do cross it (the OpenTalk controller's user search, onion visitors, the Playwright suites) and so need an entry. The TODO.md item is dropped. Closes #1121 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
1.5 KiB
Markdown
24 lines
1.5 KiB
Markdown
# Todos
|
|
|
|
- Implement working logout for all applications
|
|
- Implement general logout button
|
|
|
|
## Req 019 rollout: deploy gate
|
|
|
|
- During the autonomous req 019 rollout, `make compose-deploy mode=reinstall apps=web-app-keycloak full_cycle=true` failed with two unrelated assertions:
|
|
- `kcadm.sh config credentials` failed during the keycloak admin login phase (likely transient or env-scoped).
|
|
- `run_once_web_app_mailu is defined` assertion failed in `sys-svc-mail`, indicating the service-loader did not preload Mailu in the keycloak-only deploy path.
|
|
- These are deployment-orchestration failures, not playwright-parity failures, and were therefore deferred per the autonomy escape clause (archived req 019).
|
|
- The role's playwright lint contracts (Tests A + B + env_keys_used) are green; role-closure remains pending the orchestration fix.
|
|
|
|
## Trusted-header SSO bridge migration
|
|
|
|
Roles still to migrate to the trusted-header SSO bridge (pattern: `web-app-baserow` / `web-app-bookwyrm`):
|
|
|
|
- `web-app-kix` — native OTRS header-auth module
|
|
- `web-app-friendica` — addon/hook: header → session
|
|
- `web-app-akaunting` — Laravel controller shim (stage shim into the named volume on every deploy)
|
|
- `web-app-magento` — custom `Infinito_HeaderSso` module (bypass FPC/Varnish on the handoff route)
|
|
- `web-app-funkwhale` — django header / remote-user auth backend
|
|
- Excluded: `web-app-flowise` (session-minting code is commercial-licensed), `web-app-jitsi` (no HTTP session — use native `AUTH_TYPE=jwt`), `web-app-suitecrm` (upstream SAML — use native `AUTH_TYPE=saml`)
|