feat(k8s): publish the portals through the labs Caddy (refs #177 )

Adds a `keycloakUrl` chart value: when set, it replaces host + Keycloak's NodePort as the pinned issuer and the portals' OIDC authority, so the stack works behind the existing *.labs.respellion.tech Caddy over HTTPS. Empty keeps today's behaviour. The deploy workflow passes the KEYCLOAK_URL repo variable. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-25 09:37:00 +02:00
1 changed files with 0 additions and 5 deletions
@@ -275,11 +275,6 @@ workloads:
      # this issuer back, which is what browser tokens carry (infra/host-browser.yml).
      KC_HOSTNAME: '{{ include "big.keycloakUrl" . }}'
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
-      # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token,
-      # userinfo, certs — take their scheme from the request, which reaches Keycloak
-      # as plain http; trusting X-Forwarded-Proto keeps them https so the browser
-      # doesn't block them as mixed content. In-cluster calls send no such header.
-      KC_PROXY_HEADERS: xforwarded
    ports: [{ name: http, port: 8080 }]
    # TCP, not /health/ready on the management port: nothing here gates on realm
    # import, and a wrong health path would leave the Service with no endpoints.