Files

T

DongHyeonkaandClaude Opus 5 b2963105a8 docs(keycloak-session-store): import the session-storage lab as a new project

The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.

Follows the import procedure in README.md.

  source/     the originating repository verbatim — 78 documents, 28 SVGs,
              8 manifests, plus .source-revision recording the commit
  final/      the SSOT
    document.md   729 lines written from the 29 experiment documents, not
                  concatenated: what was predicted, what was measured, and
                  where the measurement itself was wrong
    evidence/raw    125 outputs, flattened to <experiment>__<file> because
                    the originals collided (01-baseline.txt appeared three
                    times) and the audit only globs the top level
    evidence/meta   one per raw file; command and exitCode are null and the
                    README says why rather than inventing them
    evidence/browser  22 captures
    assets/       three diagrams through techviz
    .techviz/     their VizSpecs

A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.

Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-04 22:51:59 +09:00

1.8 KiB

Raw Blame History

인증서 갱신이 서빙에 닿기까지

Alternative text

certbot 이 archive 에 새 인증서를 쓰고 live 링크를 옮기지만, nginx 워커가 교체되지 않아 옛 인증서를 계속 서빙하는 구성.

Long description

certbot renew 는 archive 디렉터리에 새 인증서를 쓰고 live 심볼릭 링크가 그것을 가리키게 한다. nginx 는 ssl_certificate 가 가리키는 파일을 기동 시점에 한 번 읽어 메모리에 보관하므로, 경로가 그대로여도 reload 없이는 옛 인증서를 계속 서빙한다. 이 실험대에서는 certbot-renew.service 의 ExecStartPost, renewal-hooks 의 세 디렉터리, certbot 의 nginx 플러그인이 모두 비어 있어 2305초 동안 옛 인증서가 서빙됐다. deploy 훅 하나를 넣자 같은 구간이 1~2초가 됐다.

Elements and evidence

certbot renew (process): ACME 로 새 인증서를 받아 archive 에 쓰고 live 링크를 옮긴다. Evidence: L499–L504.
live/fullchain.pem (datastore): 심볼릭 링크. 경로는 그대로이고 가리키는 대상만 바뀐다. Evidence: L536–L540.
renewal-hooks/deploy (process): 갱신이 실제로 일어났을 때만 실행된다. 이 실험대에서는 비어 있었다. Evidence: L527–L533.
nginx 워커 (service): 기동 시점에 읽은 인증서를 메모리에 들고 있다. reload 해야 새 워커가 새 인증서를 읽는다. Evidence: L541–L548.

Relationships

live/fullchain.pem → nginx 워커: reload 없이는 닿지 않는다. Evidence: L536–L540.
renewal-hooks/deploy → nginx 워커: reload 신호. Evidence: L556–L562.
certbot renew → renewal-hooks/deploy: 갱신 성공 시 호출. Evidence: L527–L533.
certbot renew → live/fullchain.pem: 새 인증서 기록. Evidence: L504–L510.

1.8 KiB Raw Blame History Unescape Escape