DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.5 KiB
Plaintext
39 lines
1.5 KiB
Plaintext
=== 현재 인증서 (외부 관측, sudo 불필요) ===
|
|
subject=CN = auth.hyeonworks.com
|
|
issuer=C = US, O = Let's Encrypt, CN = YE2
|
|
notBefore=Sep 3 00:47:23 2026 GMT
|
|
notAfter=Dec 2 00:47:22 2026 GMT
|
|
X509v3 Subject Alternative Name:
|
|
DNS:app1.hyeonworks.com, DNS:app2.hyeonworks.com, DNS:auth.hyeonworks.com
|
|
|
|
→ 세 호스트가 같은 인증서를 쓴다 (SAN 3개, 와일드카드 아님)
|
|
|
|
=== 체인 완결성 (fullchain vs cert 실수 확인) ===
|
|
0 s:CN = auth.hyeonworks.com
|
|
1 s:C = US, O = Let's Encrypt, CN = YE2
|
|
2 s:C = US, O = ISRG, CN = Root YE
|
|
3 s:C = US, O = Internet Security Research Group, CN = ISRG Root X2
|
|
Verify return code: 0 (ok)
|
|
|
|
→ 중간 인증서가 함께 제공된다. fullchain.pem 이 올바로 설정되어 있다.
|
|
|
|
=== 갱신 자동화 ===
|
|
NEXT LEFT LAST PASSED UNIT
|
|
Fri 2026-09-04 17:03:46 KST 1h 54min Fri 2026-09-04 03:19:39 KST 11h ago certbot-renew.timer
|
|
타이머 enabled: enabled
|
|
타이머 active: active
|
|
|
|
=== 남은 기간 ===
|
|
만료: Dec 2 00:47:22 2026 GMT
|
|
남은 일수: 88일
|
|
Let's Encrypt 90일 발급 · 30일 남으면 갱신 → 실제 갱신까지 약 58일
|
|
|
|
=== 강제 갱신은 하지 못했다 ===
|
|
$ sudo -n -l
|
|
sudo: a password is required
|
|
$ sudo -n systemctl reload nginx
|
|
sudo: a password is required
|
|
|
|
→ test-server 의 sudo 는 비밀번호를 요구한다 (게스트 kc-lab-1/2 는 무암호).
|
|
certbot renew --force-renewal 도 nginx reload 도 실행할 수 없다.
|