DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
795 B
795 B
Reverse proxy headers
TLS를 reverse proxy에서 종료하면 Keycloak은 브라우저가 사용한 외부 origin을 정확히 알아야 한다. 배포 예제는 다음 계약을 함께 적용한다.
- nginx는
Host,X-Forwarded-Host,X-Forwarded-Port,X-Forwarded-Proto,X-Forwarded-For를 덮어쓴다. - Keycloak은
KC_PROXY_HEADERS=xforwarded로 그 헤더 형식을 명시한다. KC_HOSTNAME은 외부 HTTPS URL로 고정하고 strict hostname 검증을 켠다.- Keycloak의 8080 포트는 public으로 publish하지 않고 proxy network에서만 접근시킨다. 신뢰되지 않은 클라이언트가 forwarded header를 직접 넣을 수 있으면 안 된다.
scripts/verify-reverse-proxy-headers.sh는 양쪽 설정의 짝과 nginx 구문을
검증한다.