mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c8c3f96bf9
The Keycloak vhost proxied every path to Keycloak, so the admin console and the admin REST API under /admin/realms answered any client on the internet (observed on auth.veen.world and auth.infinito.nexus), and sys-svc-proxy had no way to limit a path by source address. services.keycloak.admin.allowed_networks now takes the networks the operator declares in the inventory. When the list is non-empty, the vhost gets its own `location ^~ /admin`, rendered through the shared html.conf.j2 like `/`, with one `allow` per entry and `deny all`. The `^~` modifier keeps a regex location from taking an admin path over. The OIDC endpoints under /realms/ and the assets under /resources/ stay public. The role ships the list empty and adds no network of its own, so an inventory that declares nothing renders today's vhost unchanged. kc_admin_networks rejects anything but a list of addresses or CIDR blocks without host bits, so a typo fails the render instead of the nginx reload. The deploy's own admin calls do not cross the vhost: every kcadm.sh login, including web-app-opentalk's and web-app-mattermost's, runs inside the Keycloak container against a loopback URL, and a unit test now pins that. The README names the callers that do cross it (the OpenTalk controller's user search, onion visitors, the Playwright suites) and so need an entry. The TODO.md item is dropped. Closes #1121 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>