From 54943632219aec65bef176bbec909e0cb1b6d856 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 25 Sep 2026 12:30:15 +0000 Subject: [PATCH] fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177) (#180) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What & why Follow-up to #179. After login through `https://big-mijn.labs.respellion.tech`, the browser blocked the token request as mixed content. `KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true` makes Keycloak build its token, userinfo and certs URLs from the incoming request. Behind the labs Caddy that request arrives as plain `http`, so the discovery document listed `http://big-auth…/token`. `KC_PROXY_HEADERS=xforwarded` makes Keycloak trust the `X-Forwarded-Proto: https` that Caddy sends. In-cluster calls (the BFF → `keycloak:8080`) carry no such header, so they are unchanged, and so is the localhost/NodePort setup. Refs #177 ## Definition of Done - [x] Linked Gitea issue (above). - [ ] Failing test committed before the implementation. *(One env var, verified live instead.)* - [x] Conventional Commits referencing the issue (`refs #NN`). - [ ] CI green - [x] Docs updated if behaviour, contracts, or operations changed. *(Comment in values.yaml.)* ## Notes for reviewers - I already applied this to the running cluster with `kubectl set env` and checked it. Both realms' discovery documents now have 0 `http://` URLs, and a `jan-burger` token from the public Keycloak still gets a 204 from the BFF. Merging keeps the next deploy from reverting it. - Keycloak now trusts `X-Forwarded-*` from anything that can reach it. Its only entry points are in-cluster callers and the NodePort, which the reverse tunnel exposes only to Caddy. `KC_PROXY_TRUSTED_ADDRESSES` could narrow that if the NodePort is ever exposed more widely. 🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: https://git.labs.respellion.tech/eho/register-referentie/pulls/180 --- infra/helm/big-reference/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/helm/big-reference/values.yaml b/infra/helm/big-reference/values.yaml index 1fb687f..2ef6cda 100644 --- a/infra/helm/big-reference/values.yaml +++ b/infra/helm/big-reference/values.yaml @@ -286,6 +286,11 @@ workloads: # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak # keeps its stock theme and the mounted big-demo theme is unused. KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}' + # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token, + # userinfo, certs — take their scheme from the request, which reaches Keycloak + # as plain http; trusting X-Forwarded-Proto keeps them https so the browser + # doesn't block them as mixed content. In-cluster calls send no such header. + KC_PROXY_HEADERS: xforwarded ports: [{ name: http, port: 8080 }] # TCP, not /health/ready on the management port: nothing here gates on realm # import, and a wrong health path would leave the Service with no endpoints.