mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
7b57ba4898
A bare KC_HOSTNAME combined with KC_HOSTNAME_STRICT=false lets Keycloak derive scheme and port from the incoming request. The browser reaches the realm through the proxy on port 80 while container-to-container calls reach it on keycloak:8080, so the same realm mints two different issuers and userinfo rejects the front-channel token with 'Invalid token issuer'. OIDC.URL carries the scheme, which Keycloak uses verbatim. It is also the value group_vars/all/11_oidc.yml:19 already hands every client as the expected issuer, so server and clients now agree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
Django/Jinja
40 lines
1.2 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
KC_HOSTNAME={{ OIDC.URL }}
|
|
KC_HTTP_ENABLED=true
|
|
|
|
{% if not (lookup('tls', application_id, 'enabled') | bool) %}
|
|
KC_HOSTNAME_STRICT=false
|
|
KC_HOSTNAME_STRICT_HTTPS=false
|
|
{% endif %}
|
|
|
|
KC_PROXY_HEADERS=xforwarded
|
|
|
|
{% if DEPLOYMENT_MODE == 'swarm' %}
|
|
KC_CACHE=ispn
|
|
KC_CACHE_STACK=jdbc-ping
|
|
KC_CACHE_EMBEDDED_NETWORK_BIND_ADDRESS=match-address:{{ lookup('subnet_address_regex') }}
|
|
{% else %}
|
|
KC_CACHE=local
|
|
{% endif %}
|
|
|
|
KC_HEALTH_ENABLED={{ KEYCLOAK_HEALTH_ENABLED | lower }}
|
|
KC_METRICS_ENABLED=true
|
|
|
|
KC_DB={{ lookup('database', application_id, 'type') }}
|
|
KC_DB_URL={{ lookup('database', application_id, 'url_jdbc') }}
|
|
KC_DB_USERNAME={{ lookup('database', application_id, 'username') }}
|
|
KC_DB_PASSWORD={{ lookup('database', application_id, 'password') | dotenv_quote }}
|
|
|
|
KC_BOOTSTRAP_ADMIN_USERNAME={{ KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME }}
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD={{ KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD | dotenv_quote }}
|
|
|
|
KEYCLOAK_PERMANENT_ADMIN_USERNAME={{ KEYCLOAK_PERMANENT_ADMIN_USERNAME }}
|
|
KEYCLOAK_PERMANENT_ADMIN_PASSWORD={{ KEYCLOAK_PERMANENT_ADMIN_PASSWORD | dotenv_quote }}
|
|
|
|
{% if MODE_DEBUG | bool %}
|
|
KC_LOG_LEVEL=INFO
|
|
KC_LOG_LEVEL_ORG_KEYCLOAK_STORAGE_LDAP=DEBUG
|
|
KC_LOG_LEVEL_ORG_LDAPSDK=DEBUG
|
|
{% endif %}
|