fix(infra): local compose parity + host-browser OIDC (closes #91) #92

2026-07-16T12:08:12Z

not commented

2026-07-16 12:08:12 +00:00

What & why

Closes #91. infra/docker-compose.local.yml (the no-make local stack) was missing the domain service and all three portals, and never wired host-browser OIDC — so browsing the behandel portal redirected to http://keycloak:8080/…, which a host browser can't resolve.

Parity: add domain, self-service, openbaar, behandel (local now matches the CI-canonical docker-compose.yml service-for-service).
BFF: give it the Keycloak + downstream env it was missing (it previously fell back to appsettings and couldn't reach Keycloak).
Host-browser OIDC: pin Keycloak's frontend/issuer URL to http://localhost:8180 (KC_HOSTNAME) with KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true, so a host browser logs in on localhost:8180 while the BFF still validates in-network via keycloak:8080.
Portals: bind-mount a localhost:8180 config.json over the image's baked keycloak:8080 one (infra/local-config/*). openbaar is anonymous, no config.

How verified

docker compose -f infra/docker-compose.local.yml config valid; parity check shows nothing missing.
Started Keycloak from the local compose and confirmed the discovery document:
- host view (localhost:8180): issuer + all endpoints on localhost:8180 (what the browser uses).
- in-network view (keycloak:8080): issuer stays http://localhost:8180/... (matches browser tokens) while jwks_uri/token_endpoint resolve to keycloak:8080 (reachable by the BFF).

Notes for reviewers

The full portal→BFF→Keycloak login round-trip should get a quick browser smoke test on a real engine (I validated the Keycloak issuer/backchannel split and compose validity, but can't drive a browser here). Ports: self-service :8140, openbaar :8141, behandel :8142; users in docs/synthetic-data.md.
On rootless podman the portal→BFF nginx proxy (resolver 127.0.0.11) may 502 (a separate known podman-vs-docker DNS quirk); login is a browser redirect and is unaffected. Works on Docker Desktop.
No app-code change; docker-compose.yml (CI-canonical) is untouched.

## What & why Closes #91. `infra/docker-compose.local.yml` (the no-make local stack) was missing the `domain` service and all three portals, and never wired host-browser OIDC — so browsing the behandel portal redirected to `http://keycloak:8080/…`, which a host browser can't resolve. - **Parity**: add `domain`, `self-service`, `openbaar`, `behandel` (local now matches the CI-canonical `docker-compose.yml` service-for-service). - **BFF**: give it the Keycloak + downstream env it was missing (it previously fell back to appsettings and couldn't reach Keycloak). - **Host-browser OIDC**: pin Keycloak's frontend/issuer URL to `http://localhost:8180` (`KC_HOSTNAME`) with `KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true`, so a host browser logs in on `localhost:8180` while the BFF still validates in-network via `keycloak:8080`. - **Portals**: bind-mount a `localhost:8180` `config.json` over the image's baked `keycloak:8080` one (`infra/local-config/*`). openbaar is anonymous, no config. ## How verified - `docker compose -f infra/docker-compose.local.yml config` valid; parity check shows nothing missing. - Started Keycloak from the local compose and confirmed the discovery document: - **host view** (`localhost:8180`): `issuer` + all endpoints on `localhost:8180` (what the browser uses). - **in-network view** (`keycloak:8080`): `issuer` stays `http://localhost:8180/...` (matches browser tokens) while `jwks_uri`/`token_endpoint` resolve to `keycloak:8080` (reachable by the BFF). ## Notes for reviewers - The full portal→BFF→Keycloak login round-trip should get a quick browser smoke test on a real engine (I validated the Keycloak issuer/backchannel split and compose validity, but can't drive a browser here). Ports: self-service :8140, openbaar :8141, behandel :8142; users in `docs/synthetic-data.md`. - On rootless podman the portal→BFF nginx proxy (`resolver 127.0.0.11`) may 502 (a separate known podman-vs-docker DNS quirk); login is a browser redirect and is unaffected. Works on Docker Desktop. - No app-code change; `docker-compose.yml` (CI-canonical) is untouched.

not added 1 commit 2026-07-16 12:08:14 +00:00

fix(infra): local compose parity — add domain + portals, wire host-browser OIDC (closes #91 )

CI / lint (pull_request) Successful in 1m20s

Details

CI / unit (pull_request) Has been cancelled

Details

CI / build (pull_request) Has been cancelled

Details

CI / frontend (pull_request) Has been cancelled

Details

CI / mutation (pull_request) Has been cancelled

Details

CI / verify-stack (pull_request) Has been cancelled

Details

9fc7b4487b

docker-compose.local.yml lacked the domain service and all three portals, and never wired

host-browser OIDC. Add them, give the BFF its Keycloak/downstream env, and pin Keycloak's issuer

to http://localhost:8180 with a dynamic backchannel so a host browser logs in on localhost:8180

while the BFF still validates in-network via keycloak:8080. Portals bind-mount a localhost:8180

config.json over the baked keycloak:8080 one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added the type:bug area:infra labels 2026-07-16 12:08:15 +00:00

not added 1 commit 2026-07-16 12:20:58 +00:00

Merge branch 'main' into fix/91-local-compose-parity

CI / build (pull_request) Successful in 1m15s

Details

CI / lint (pull_request) Successful in 1m19s

Details

CI / unit (pull_request) Successful in 1m28s

Details

CI / frontend (pull_request) Successful in 3m32s

Details

CI / mutation (pull_request) Successful in 6m13s

Details

CI / verify-stack (pull_request) Successful in 7m41s

Details

e94a2a38bb

not merged commit 951bdd8364 into main

2026-07-16 12:45:09 +00:00

not referenced this issue from a commit

2026-07-16 12:45:09 +00:00

fix(infra): local compose parity + host-browser OIDC (closes #91) (#92)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#92