donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

docs(keycloak-session-store): import the session-storage lab as a new project

Browse Source 
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.

Follows the import procedure in README.md.

  source/     the originating repository verbatim — 78 documents, 28 SVGs,
              8 manifests, plus .source-revision recording the commit
  final/      the SSOT
    document.md   729 lines written from the 29 experiment documents, not
                  concatenated: what was predicted, what was measured, and
                  where the measurement itself was wrong
    evidence/raw    125 outputs, flattened to <experiment>__<file> because
                    the originals collided (01-baseline.txt appeared three
                    times) and the audit only globs the top level
    evidence/meta   one per raw file; command and exitCode are null and the
                    README says why rather than inventing them
    evidence/browser  22 captures
    assets/       three diagrams through techviz
    .techviz/     their VizSpecs

A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.

Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
2026-09-04 22:51:59 +09:00
co-authored by Claude Opus 5
parent 43bccd08a8
commit b2963105a8
5017 changed files with 372751 additions and 4943 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.alt.md
+23
View File
@@ -0,0 +1,23 @@
# 인증서 갱신이 서빙에 닿기까지
## Alternative text
certbot 이 archive 에 새 인증서를 쓰고 live 링크를 옮기지만, nginx 워커가 교체되지 않아 옛 인증서를 계속 서빙하는 구성.
## Long description
certbot renew 는 archive 디렉터리에 새 인증서를 쓰고 live 심볼릭 링크가 그것을 가리키게 한다. nginx 는 ssl_certificate 가 가리키는 파일을 기동 시점에 한 번 읽어 메모리에 보관하므로, 경로가 그대로여도 reload 없이는 옛 인증서를 계속 서빙한다. 이 실험대에서는 certbot-renew.service 의 ExecStartPost, renewal-hooks 의 세 디렉터리, certbot 의 nginx 플러그인이 모두 비어 있어 2305초 동안 옛 인증서가 서빙됐다. deploy 훅 하나를 넣자 같은 구간이 1~2초가 됐다.
## Elements and evidence
- **certbot renew** (process): ACME 로 새 인증서를 받아 archive 에 쓰고 live 링크를 옮긴다. Evidence: L499–L504.
- **live/fullchain.pem** (datastore): 심볼릭 링크. 경로는 그대로이고 가리키는 대상만 바뀐다. Evidence: L536–L540.
- **renewal-hooks/deploy** (process): 갱신이 실제로 일어났을 때만 실행된다. 이 실험대에서는 비어 있었다. Evidence: L527–L533.
- **nginx 워커** (service): 기동 시점에 읽은 인증서를 메모리에 들고 있다. reload 해야 새 워커가 새 인증서를 읽는다. Evidence: L541–L548.
## Relationships
- **live/fullchain.pem → nginx 워커:** reload 없이는 닿지 않는다. Evidence: L536–L540.
- **renewal-hooks/deploy → nginx 워커:** reload 신호. Evidence: L556–L562.
- **certbot renew → renewal-hooks/deploy:** 갱신 성공 시 호출. Evidence: L527–L533.
- **certbot renew → live/fullchain.pem:** 새 인증서 기록. Evidence: L504–L510.
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.d2
+19
View File
@@ -0,0 +1,19 @@
# 인증서 갱신이 서빙에 닿기까지
# Question: certbot 이 갱신에 성공한 뒤 nginx 가 새 인증서를 서빙하기까지 무엇이 필요한가
direction: right
n0: "certbot renew" {
shape: rectangle
}
n1: "live/fullchain.pem" {
shape: cylinder
}
n2: "renewal-hooks/deploy" {
shape: rectangle
}
n3: "nginx 워커" {
shape: rectangle
}
n0 -> n1: "새 인증서 기록"
n1 -> n3: "reload 없이는 닿지 않는다"
n0 -> n2: "갱신 성공 시 호출"
n2 -> n3: "reload 신호"
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.dot
+13
View File
@@ -0,0 +1,13 @@
digraph techviz {
graph [rankdir=LR, splines=ortho, nodesep=0.55, ranksep=0.85];
node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
n0 [label="certbot renew", shape=box, style="rounded,filled"];
n1 [label="live/fullchain.pem", shape=cylinder, style="rounded,filled"];
n2 [label="renewal-hooks/deploy", shape=box, style="rounded,filled"];
n3 [label="nginx 워커", shape=box, style="rounded,filled"];
n0 -> n1 [label="새 인증서 기록", style=solid];
n1 -> n3 [label="reload 없이는 닿지 않는다", style=solid];
n0 -> n2 [label="갱신 성공 시 호출", style=solid];
n2 -> n3 [label="reload 신호", style=solid];
}
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.drawio
+43
View File
@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="renewal-to-serving-gap" name="인증서 갱신이 서빙에 닿기까지">
<mxGraphModel dx="958" dy="345" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="958" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="n_certbot" value="certbot renew&lt;br/&gt;--force-renewal" tooltip="ACME 로 새 인증서를 받아 archive 에 쓰고 live 링크를 옮긴다. | Evidence: L499-L504" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="70.0" y="144.5" width="150.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_deploy-hook" value="renewal-hooks/deploy&lt;br/&gt;nginx -t &amp;&amp; nginx -s reload" tooltip="갱신이 실제로 일어났을 때만 실행된다. 이 실험대에서는 비어 있었다. | Evidence: L527-L533" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="380.0" y="60.0" width="223.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_live-link" value="live/fullchain.pem&lt;br/&gt;archive/cert2.pem 을 가리킨다" tooltip="심볼릭 링크. 경로는 그대로이고 가리키는 대상만 바뀐다. | Evidence: L536-L540" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;shape=cylinder3;boundedLbl=1;backgroundOutline=1;fillColor=#eef6fb;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="390.5" y="203.0" width="202.0" height="97.0" as="geometry"/>
</mxCell>
<mxCell id="n_nginx" value="nginx 워커&lt;br/&gt;마스터 유지 · 워커 교체" tooltip="기동 시점에 읽은 인증서를 메모리에 들고 있다. reload 해야 새 워커가 새 인증서를 읽는다. | Evidence: L541-L548" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="763.0" y="144.5" width="150.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="e_needs-reload" value="reload 없이는 닿지 않는다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_live-link" target="n_nginx">
<mxGeometry relative="1" as="geometry">
<mxPoint x="701.8" y="220.2" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_reload" value="reload 신호" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_deploy-hook" target="n_nginx">
<mxGeometry relative="1" as="geometry">
<mxPoint x="707.0" y="133.2" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_trigger" value="갱신 성공 시 호출" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_certbot" target="n_deploy-hook">
<mxGeometry relative="1" as="geometry">
<mxPoint x="324.0" y="133.2" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_write" value="새 인증서 기록" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_certbot" target="n_live-link">
<mxGeometry relative="1" as="geometry">
<mxPoint x="329.2" y="220.2" as="offset"/>
</mxGeometry>
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.excalidraw
+685
View File
@@ -0,0 +1,685 @@
{
"type": "excalidraw",
"version": 2,
"source": "techviz-harness",
"elements": [
{
"id": "edge-needs-reload",
"type": "arrow",
"x": 592.5,
"y": 189.0,
"width": 170.5,
"height": 62.5,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1577249544,
"version": 1,
"versionNonce": 1042295668,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
62.5
],
[
85.25,
62.5
],
[
85.25,
0.0
],
[
170.5,
0.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-live-link",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-nginx",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-needs-reload",
"type": "text",
"x": 633.75,
"y": 208.25,
"width": 136,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 278777416,
"version": 1,
"versionNonce": 1376359326,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "reload 없이는 닿지 않는다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "reload 없이는 닿지 않는다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-reload",
"type": "arrow",
"x": 603.0,
"y": 95.5,
"width": 160.0,
"height": 75.5,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1902174425,
"version": 1,
"versionNonce": 161076942,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
80.0,
0.0
],
[
80.0,
75.5
],
[
160.0,
75.5
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-deploy-hook",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-nginx",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-reload",
"type": "text",
"x": 662.0,
"y": 121.25,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 270912085,
"version": 1,
"versionNonce": 53783526,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "reload 신호",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "reload 신호",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-trigger",
"type": "arrow",
"x": 220.0,
"y": 95.5,
"width": 160.0,
"height": 75.5,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 83999125,
"version": 1,
"versionNonce": 500218362,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
75.5
],
[
80.0,
75.5
],
[
80.0,
0.0
],
[
160.0,
0.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-certbot",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-deploy-hook",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-trigger",
"type": "text",
"x": 279.0,
"y": 121.25,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 96794064,
"version": 1,
"versionNonce": 1708323917,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "갱신 성공 시 호출",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "갱신 성공 시 호출",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-write",
"type": "arrow",
"x": 220.0,
"y": 189.0,
"width": 170.5,
"height": 62.5,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 312943584,
"version": 1,
"versionNonce": 1620813948,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
85.25,
0.0
],
[
85.25,
62.5
],
[
170.5,
62.5
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-certbot",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-live-link",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-write",
"type": "text",
"x": 284.25,
"y": 208.25,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 162145258,
"version": 1,
"versionNonce": 224572303,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "새 인증서 기록",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "새 인증서 기록",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-certbot",
"type": "rectangle",
"x": 70.0,
"y": 144.5,
"width": 150.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 270998768,
"version": 1,
"versionNonce": 1218113568,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-certbot",
"type": "text",
"x": 80.0,
"y": 154.5,
"width": 130.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1702027576,
"version": 1,
"versionNonce": 1134169150,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "certbot renew\n--force-renewal",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "certbot renew\n--force-renewal",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-deploy-hook",
"type": "rectangle",
"x": 380.0,
"y": 60.0,
"width": 223.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 718598406,
"version": 1,
"versionNonce": 1876629676,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-deploy-hook",
"type": "text",
"x": 390.0,
"y": 70.0,
"width": 203.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 126617100,
"version": 1,
"versionNonce": 660765138,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "renewal-hooks/deploy\nnginx -t && nginx -s reload",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "renewal-hooks/deploy\nnginx -t && nginx -s reload",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-live-link",
"type": "rectangle",
"x": 390.5,
"y": 203.0,
"width": 202.0,
"height": 97.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#e7f5ff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1255535587,
"version": 1,
"versionNonce": 438846951,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-live-link",
"type": "text",
"x": 400.5,
"y": 213.0,
"width": 182.0,
"height": 77.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1305631597,
"version": 1,
"versionNonce": 1804769663,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "live/fullchain.pem\narchive/cert2.pem 을 가리킨다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "live/fullchain.pem\narchive/cert2.pem 을 가리킨다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-nginx",
"type": "rectangle",
"x": 763.0,
"y": 144.5,
"width": 150.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 721013300,
"version": 1,
"versionNonce": 1520646945,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-nginx",
"type": "text",
"x": 773.0,
"y": 154.5,
"width": 130.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 117243520,
"version": 1,
"versionNonce": 936748041,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "nginx 워커\n마스터 유지 · 워커 교체",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "nginx 워커\n마스터 유지 · 워커 교체",
"autoResize": true,
"lineHeight": 1.25
}
],
"appState": {
"gridSize": 10,
"viewBackgroundColor": "#ffffff",
"currentItemFontFamily": 5
},
"files": {}
}
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.manifest.json
+32
View File
@@ -0,0 +1,32 @@
{
"harness_version": "0.2.0",
"spec_id": "renewal-to-serving-gap",
"spec_version": "1.1",
"spec_sha256": "3e3db52f9abd54ed3f8d6d45e2bff22ba1c2fa312dfb8185d7d5c5c3b5ea24be",
"source_context": {
"document": "docs/keycloak-session-store/final/document.md",
"document_sha256": "609353e10bfd37a9bbb6a79ecf2a32f3d3c02d5d161879a14ad4713e49e7e5e8",
"anchor": {
"kind": "heading",
"value": "D-4 · D-4a — 인증서, 그리고 이 실험대 최대의 발견",
"line": 497
}
},
"outputs": [
"renewal-to-serving-gap.svg",
"renewal-to-serving-gap.mmd",
"renewal-to-serving-gap.d2",
"renewal-to-serving-gap.dot",
"renewal-to-serving-gap.drawio",
"renewal-to-serving-gap.excalidraw",
"renewal-to-serving-gap.alt.md"
],
"lint_issue_count": 0,
"assumption_count": 0,
"assumptions_allowed": false,
"composition_profile": "component-flow",
"reference_ids": [
"payment-event-flow"
],
"diagram_only": true
}
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.mmd
+11
View File
@@ -0,0 +1,11 @@
%% 인증서 갱신이 서빙에 닿기까지
%% question: certbot 이 갱신에 성공한 뒤 nginx 가 새 인증서를 서빙하기까지 무엇이 필요한가
flowchart LR
n0["certbot renew"]
n1[("live/fullchain.pem")]
n2["renewal-hooks/deploy"]
n3["nginx 워커"]
n0 -->|"새 인증서 기록"| n1
n1 -->|"reload 없이는 닿지 않는다"| n3
n0 -->|"갱신 성공 시 호출"| n2
n2 -->|"reload 신호"| n3
docs/keycloak-session-store/final/assets/renewal-to-serving-gap/renewal-to-serving-gap.svg
+89
View File
@@ -0,0 +1,89 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="958" height="345" viewBox="0 0 958 345" role="img" aria-labelledby="diagram-title diagram-description">
<title id="diagram-title">인증서 갱신이 서빙에 닿기까지</title>
<desc id="diagram-description">certbot renew 는 archive 디렉터리에 새 인증서를 쓰고 live 심볼릭 링크가 그것을 가리키게 한다. nginx 는 ssl_certificate 가 가리키는 파일을 기동 시점에 한 번 읽어 메모리에 보관하므로, 경로가 그대로여도 reload 없이는 옛 인증서를 계속 서빙한다. 이 실험대에서는 certbot-renew.service 의 ExecStartPost, renewal-hooks 의 세 디렉터리, certbot 의 nginx 플러그인이 모두 비어 있어 2305초 동안 옛 인증서가 서빙됐다. deploy 훅 하나를 넣자 같은 구간이 1~2초가 됐다.</desc>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;renewal-to-serving-gap&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;docs/keycloak-session-store/final/document.md&quot;,&quot;document_sha256&quot;:&quot;609353e10bfd37a9bbb6a79ecf2a32f3d3c02d5d161879a14ad4713e49e7e5e8&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;heading&quot;,&quot;value&quot;:&quot;D-4 · D-4a — 인증서, 그리고 이 실험대 최대의 발견&quot;,&quot;line&quot;:497}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" />
</marker>
<style>
:root { color-scheme: light; }
text { font-family: Inter, Pretendard, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; fill: #111827; }
.canvas { fill: #ffffff; }
.group-box { fill: #ffffff; stroke: #9ca3af; stroke-width: 1.4; stroke-dasharray: 7 5; }
.group-label-bg { fill: #ffffff; }
.group-label { font-size: 13px; font-weight: 650; fill: #374151; }
.edge { fill: none; stroke: #374151; stroke-width: 1.8; stroke-linejoin: round; stroke-linecap: round; marker-end: url(#arrow); }
.edge.style-dashed, .edge.semantic-dashed, .edge.assumption { stroke-dasharray: 7 5; }
.edge.style-dotted { stroke-dasharray: 2 5; }
.edge.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.edge.emphasis-muted { stroke: #9ca3af; }
.edge.emphasis-warning, .edge.kind-failure, .edge.kind-error { stroke: #dc2626; stroke-width: 2.2; }
.edge-label-bg { fill: #ffffff; }
.edge-label { font-size: 12px; font-weight: 560; text-anchor: middle; }
.node-shape { fill: #ffffff; stroke: #4b5563; stroke-width: 1.7; }
.node-shape.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-shape.emphasis-muted { stroke: #9ca3af; fill: #f9fafb; }
.node-shape.emphasis-warning { stroke: #d97706; stroke-width: 2; fill: #fffdf5; }
.node-shape.kind-database, .node-shape.kind-datastore, .node-shape.kind-storage { fill: #f8fafc; }
.node-shape.kind-queue, .node-shape.kind-event, .node-shape.kind-topic { fill: #fafafa; }
.node-shape.assumption { stroke-dasharray: 4 4; }
.storage-bottom, .controller-divider { fill: none; stroke: #4b5563; stroke-width: 1.4; }
.controller-led { fill: #4b5563; }
.actor-symbol { fill: none; stroke: #4b5563; stroke-width: 1.8; stroke-linecap: round; }
.actor-symbol.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-label { font-size: 14px; font-weight: 650; text-anchor: middle; }
.node-role { font-size: 10px; letter-spacing: 0.04em; text-anchor: middle; fill: #6b7280; }
.node-detail-divider { stroke: #d1d5db; stroke-width: 1; }
.node-detail { font-size: 11px; fill: #374151; }
.assumption-badge { font-size: 9px; font-weight: 700; fill: #92400e; }
.failure-mark { stroke: #dc2626; stroke-width: 4; stroke-linecap: round; }
.lifeline { stroke: #9ca3af; stroke-width: 1.2; stroke-dasharray: 5 5; }
.timeline-axis { stroke: #374151; stroke-width: 1.8; marker-end: url(#arrow); }
.timeline-stem { stroke: #6b7280; stroke-width: 1.3; }
.timeline-marker { fill: #ffffff; stroke: #374151; stroke-width: 1.7; }
.timeline-marker.primary { fill: #2563eb; stroke: #2563eb; }
.timeline-marker.warning { fill: #dc2626; stroke: #dc2626; }
.timeline-label { font-size: 13px; font-weight: 650; text-anchor: middle; }
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
</style>
</defs>
<rect class="canvas" width="958" height="345" />
<polyline class="edge kind-blocked style-solid emphasis-normal" points="592.5,251.5 677.8,251.5 677.8,189.0 763.0,189.0" data-evidence="536-540" />
<rect class="edge-label-bg" x="635.8" y="206.2" width="131.9" height="22" rx="3" />
<text class="edge-label" x="701.8" y="221.2">reload 없이는 닿지 않는다</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="603.0,95.5 683.0,95.5 683.0,171.0 763.0,171.0" data-evidence="556-562" />
<rect class="edge-label-bg" x="667.9" y="119.2" width="78.3" height="22" rx="3" />
<text class="edge-label" x="707.0" y="134.2">reload 신호</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="220.0,171.0 300.0,171.0 300.0,95.5 380.0,95.5" data-evidence="527-533" />
<rect class="edge-label-bg" x="281.5" y="119.2" width="85.0" height="22" rx="3" />
<text class="edge-label" x="324.0" y="134.2">갱신 성공 시 호출</text>
<polyline class="edge kind-write style-solid emphasis-normal" points="220.0,189.0 305.2,189.0 305.2,251.5 390.5,251.5" data-evidence="504-510" />
<rect class="edge-label-bg" x="293.4" y="206.2" width="71.6" height="22" rx="3" />
<text class="edge-label" x="329.2" y="221.2">새 인증서 기록</text>
<g id="node-certbot">
<rect class="node-shape kind-process emphasis-primary role-source" data-evidence="499-504" x="70.0" y="144.5" width="150.0" height="71.0" rx="7" />
<text class="node-label" x="145.0" y="171.5">certbot renew</text>
<line class="node-detail-divider" x1="84.0" y1="192.5" x2="206.0" y2="192.5" />
<text class="node-detail" x="86.0" y="209.5">--force-renewal</text>
</g>
<g id="node-deploy-hook">
<rect class="node-shape kind-process emphasis-warning role-control" data-evidence="527-533" x="380.0" y="60.0" width="223.0" height="71.0" rx="7" />
<text class="node-label" x="491.5" y="87.0">renewal-hooks/deploy</text>
<line class="node-detail-divider" x1="394.0" y1="108.0" x2="589.0" y2="108.0" />
<text class="node-detail" x="396.0" y="125.0">nginx -t &amp;&amp; nginx -s reload</text>
</g>
<g id="node-live-link">
<rect class="node-shape kind-datastore emphasis-primary role-store" data-evidence="536-540" x="390.5" y="216.0" width="202.0" height="71.0" /><ellipse class="node-shape kind-datastore emphasis-primary role-store" cx="491.5" cy="216.0" rx="101.0" ry="13.0" /><path class="storage-bottom" d="M 390.5 287.0 A 101.0 13.0 0 0 0 592.5 287.0" />
<text class="node-label" x="491.5" y="243.0">live/fullchain.pem</text>
<line class="node-detail-divider" x1="404.5" y1="264.0" x2="578.5" y2="264.0" />
<text class="node-detail" x="406.5" y="281.0">archive/cert2.pem 을 가리킨다</text>
</g>
<g id="node-nginx">
<rect class="node-shape kind-service emphasis-primary role-target" data-evidence="541-548" x="763.0" y="144.5" width="150.0" height="71.0" rx="7" />
<text class="node-label" x="838.0" y="171.5">nginx 워커</text>
<line class="node-detail-divider" x1="777.0" y1="192.5" x2="899.0" y2="192.5" />
<text class="node-detail" x="779.0" y="209.5">마스터 유지 · 워커 교체</text>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.6 KiB