eho/register-referentie
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

docs(arch): ADR-0035 — publish the stack through the existing labs Caddy (closes #177) #185

Open
not wants to merge 1 commits from docs/177-adr-labs-caddy into main
pull from: docs/177-adr-labs-caddy
merge into: :main
Conversation 0 Commits 1 Files Changed 3
+111
not commented 2026-09-25 13:05:52 +00:00
Contributor
Copy Link
Copy Source

What & why

ADR-0035 records the decision issue #177 asked for, which went the other way from its proposal. The stack is published through the existing labs Caddy over a reverse SSH tunnel, not through an in-cluster Caddy edge. The deciding facts: the Talos hypervisor sits behind office NAT with no inbound path, and the labs Caddy already holds 80/443 and the *.labs.respellion.tech wildcard certificate.

The ADR covers the chain (Caddy → openssh-server → tunnel → NodePorts), keycloakUrl / big.keycloakUrl, KC_PROXY_HEADERS, the optional demo OTP autofill, the alternatives (including the closed PR #178), and the costs: routing outside the cluster, two SSH hops, a single issuer string, public demo portals, and 401s after a Keycloak restart.

  • docs/architecture/adr-0035-public-access-through-the-labs-caddy.md (new)
  • mkdocs.yml: nav entry (check-docs-nav.py passes)
  • docs/runbooks/kubernetes-talos.md: links the ADR from "Publishing through the labs Caddy"

Closes #177

Definition of Done

  • Linked Gitea issue (above).
  • Conventional Commit referencing the issue.
  • CI green
  • ADR added in docs/architecture/.

Notes for reviewers

  • The number 0035 was used in the unmerged #178 for the in-cluster ADR. That ADR never reached main, so the number is free there.
  • Implementation PRs: #179, #180, #181. Related CI fixes: #183, #184.

🤖 Generated with Claude Code

## What & why ADR-0035 records the decision issue #177 asked for, which went the other way from its proposal. The stack is published through the **existing labs Caddy** over a reverse SSH tunnel, not through an in-cluster Caddy edge. The deciding facts: the Talos hypervisor sits behind office NAT with no inbound path, and the labs Caddy already holds 80/443 and the `*.labs.respellion.tech` wildcard certificate. The ADR covers the chain (Caddy → `openssh-server` → tunnel → NodePorts), `keycloakUrl` / `big.keycloakUrl`, `KC_PROXY_HEADERS`, the optional demo OTP autofill, the alternatives (including the closed PR #178), and the costs: routing outside the cluster, two SSH hops, a single issuer string, public demo portals, and 401s after a Keycloak restart. - `docs/architecture/adr-0035-public-access-through-the-labs-caddy.md` (new) - `mkdocs.yml`: nav entry (`check-docs-nav.py` passes) - `docs/runbooks/kubernetes-talos.md`: links the ADR from "Publishing through the labs Caddy" Closes #177 ## Definition of Done - [x] Linked Gitea issue (above). - [x] Conventional Commit referencing the issue. - [ ] CI green - [x] ADR added in `docs/architecture/`. ## Notes for reviewers - The number 0035 was used in the unmerged #178 for the in-cluster ADR. That ADR never reached `main`, so the number is free there. - Implementation PRs: #179, #180, #181. Related CI fixes: #183, #184. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
not added 1 commit 2026-09-25 13:05:54 +00:00
docs(arch): ADR-0035 — publish the stack through the existing labs Caddy (closes #177)
CI / lint (pull_request) Successful in 1m45s
Details
CI / k8s (pull_request) Successful in 9s
Details
CI / build (pull_request) Successful in 1m41s
Details
CI / unit (pull_request) Successful in 2m3s
Details
CI / frontend (pull_request) Successful in 2m23s
Details
CI / mutation (pull_request) Successful in 5m39s
Details
CI / verify-stack (pull_request) Skipped
Details
84cea6267e 
Records the decision #177 asked for, the other way round: the hypervisor has no
inbound path and the labs Caddy already holds 80/443 and the wildcard cert, so
the portals go through it over a reverse SSH tunnel instead of an in-cluster
edge. Covers keycloakUrl, KC_PROXY_HEADERS and the optional demo OTP autofill.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
All checks were successful
CI / lint (pull_request) Successful in 1m45s
Required
Details
CI / k8s (pull_request) Successful in 9s
Details
CI / build (pull_request) Successful in 1m41s
Required
Details
CI / unit (pull_request) Successful in 2m3s
Required
Details
CI / frontend (pull_request) Successful in 2m23s
Required
Details
CI / mutation (pull_request) Successful in 5m39s
Required
Details
CI / verify-stack (pull_request) Skipped
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin docs/177-adr-labs-caddy:docs/177-adr-labs-caddy
git checkout docs/177-adr-labs-caddy
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area:acl
area:bff
area:docs
area:domain
area:event-subscriber
area:infra
area:portal-behandel
area:portal-beheer
area:portal-openbaar
area:portal-self-service
area:projection
area:workflow
type:adr-proposal
type:bug
type:chore
type:slice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
eho (Edwin van den Houdt)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: eho/register-referentie#185