feat(k8s): publish the portals through the labs Caddy (refs #177) #179

2026-09-25T07:40:16Z

not commented

2026-09-25 07:40:16 +00:00

What & why

Makes the portals reachable on real hostnames through the Caddy that already fronts *.labs.respellion.tech, instead of five SSH port-forwards:

URL	Service
`https://big-register.labs.respellion.tech`	openbaar
`https://big-mijn.labs.respellion.tech`	self-service
`https://big-behandel.labs.respellion.tech`	behandel
`https://big-beheer.labs.respellion.tech`	beheer
`https://big-auth.labs.respellion.tech`	Keycloak (`/admin` blocked)

Chain: browser → labs Caddy (TLS) → openssh-server container → reverse SSH tunnel → Fedora host → Talos NodePorts. The Caddy routes and the tunnel unit are already on main in the Infra repo (infra/development/).

This repo's part:

Chart: a keycloakUrl value. When set it replaces host + Keycloak's NodePort as the pinned issuer (KC_HOSTNAME) and the portals' OIDC authority. Both now come from one helper, big.keycloakUrl, so they can't drift apart (ADR-0010). Empty = rendered output identical to today.
Deploy workflow: passes the KEYCLOAK_URL repo variable as --set keycloakUrl=….
Runbook: new section "Publishing through the labs Caddy".

Refs #177

Definition of Done

Linked Gitea issue (above).
Failing test committed before the implementation. (Infra/config change, no test added.)
Implementation makes the test pass; refactor commit if structure improved.
Conventional Commits referencing the issue (refs #NN).
CI green — all Gitea Actions jobs (or make ci green while no runner exists).
docker compose up from a fresh clone reaches green health checks within 3 minutes. (Compose untouched.)
Docs updated if behaviour, contracts, or operations changed.
ADR added in docs/architecture/ if a non-obvious decision was made.
Demo note in docs/demo-script.md if user-visible.

Notes for reviewers

This takes the option #177 rejects. #177 proposes an in-cluster Caddy edge (branch feat/177-public-tls-edge). This PR uses the existing labs Caddy instead, because it already holds 80/443 and the wildcard certificate. So it only refs #177. If we go this way, #177's ADR should record the host-Caddy option instead.
make k8s-lint and infra/check-docs-nav.py pass. I rendered the chart with and without keycloakUrl: empty gives the same output as before; set, it gives https://big-auth.labs.respellion.tech for both the issuer and the authority.
Once KEYCLOAK_URL is set, the localhost port-forward workflow (runbook §5) no longer logs in, because the issuer is a single string.
The portals are public, with no Azure authorize in front of them the way marketing has one. The test users use test123.
Rollout after merge: install big-portals-tunnel.service on the Fedora host, run docker compose up -d caddy on the labs server, then set the KEYCLOAK_URL variable.

🤖 Generated with Claude Code

## What & why Makes the portals reachable on real hostnames through the Caddy that already fronts `*.labs.respellion.tech`, instead of five SSH port-forwards: | URL | Service | |---|---| | `https://big-register.labs.respellion.tech` | openbaar | | `https://big-mijn.labs.respellion.tech` | self-service | | `https://big-behandel.labs.respellion.tech` | behandel | | `https://big-beheer.labs.respellion.tech` | beheer | | `https://big-auth.labs.respellion.tech` | Keycloak (`/admin` blocked) | Chain: browser → labs Caddy (TLS) → `openssh-server` container → reverse SSH tunnel → Fedora host → Talos NodePorts. The Caddy routes and the tunnel unit are already on `main` in the Infra repo (`infra/development/`). This repo's part: - **Chart:** a `keycloakUrl` value. When set it replaces `host` + Keycloak's NodePort as the pinned issuer (`KC_HOSTNAME`) and the portals' OIDC authority. Both now come from one helper, `big.keycloakUrl`, so they can't drift apart (ADR-0010). Empty = rendered output identical to today. - **Deploy workflow:** passes the `KEYCLOAK_URL` repo variable as `--set keycloakUrl=…`. - **Runbook:** new section "Publishing through the labs Caddy". Refs #177 ## Definition of Done - [x] Linked Gitea issue (above). - [ ] Failing test committed before the implementation. *(Infra/config change, no test added.)* - [x] Implementation makes the test pass; refactor commit if structure improved. - [x] Conventional Commits referencing the issue (`refs #NN`). - [ ] CI green — all Gitea Actions jobs (or `make ci` green while no runner exists). - [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes. *(Compose untouched.)* - [x] Docs updated if behaviour, contracts, or operations changed. - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made. - [ ] Demo note in `docs/demo-script.md` if user-visible. ## Notes for reviewers - **This takes the option #177 rejects.** #177 proposes an in-cluster Caddy edge (branch `feat/177-public-tls-edge`). This PR uses the existing labs Caddy instead, because it already holds 80/443 and the wildcard certificate. So it only *refs* #177. If we go this way, #177's ADR should record the host-Caddy option instead. - `make k8s-lint` and `infra/check-docs-nav.py` pass. I rendered the chart with and without `keycloakUrl`: empty gives the same output as before; set, it gives `https://big-auth.labs.respellion.tech` for both the issuer and the authority. - Once `KEYCLOAK_URL` is set, the `localhost` port-forward workflow (runbook §5) no longer logs in, because the issuer is a single string. - The portals are public, with no Azure `authorize` in front of them the way `marketing` has one. The test users use `test123`. - Rollout after merge: install `big-portals-tunnel.service` on the Fedora host, run `docker compose up -d caddy` on the labs server, then set the `KEYCLOAK_URL` variable. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

not added 1 commit 2026-09-25 07:40:18 +00:00

feat(k8s): publish the portals through the labs Caddy (refs #177 )

CI / k8s (pull_request) Successful in 1m21s

Details

CI / build (pull_request) Successful in 4m53s

Details

CI / lint (pull_request) Successful in 6m37s

Details

CI / unit (pull_request) Successful in 1m20s

Details

CI / frontend (pull_request) Successful in 4m25s

Details

CI / mutation (pull_request) Successful in 5m23s

Details

CI / verify-stack (pull_request) Successful in 21m38s

Details

97554ff2f2

Adds a `keycloakUrl` chart value: when set, it replaces host + Keycloak's
NodePort as the pinned issuer and the portals' OIDC authority, so the stack
works behind the existing *.labs.respellion.tech Caddy over HTTPS. Empty keeps
today's behaviour. The deploy workflow passes the KEYCLOAK_URL repo variable.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not merged commit 804031eeb8 into main

2026-09-25 08:16:40 +00:00

not referenced this pull request

2026-09-25 08:40:49 +00:00

fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177) #180

not referenced this issue from a commit

2026-09-25 12:30:18 +00:00

fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177) (#180)

not referenced this pull request

2026-09-25 13:03:32 +00:00

feat(k8s): terminate TLS in the cluster for a public domain (closes #177) #178

not referenced this pull request