From b42db5e93b29edf64c49a0b53bd9ca7f73f10bb0 Mon Sep 17 00:00:00 2001 From: donghyeon-ka Date: Sat, 25 Jul 2026 16:41:03 +0900 Subject: [PATCH] docs: define single-EC2 local identity deployment --- docs/single-ec2-no-google.md | 20 ++++++++++++++++++++ scripts/verify-single-ec2-no-google.sh | 14 ++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 docs/single-ec2-no-google.md create mode 100755 scripts/verify-single-ec2-no-google.sh diff --git a/docs/single-ec2-no-google.md b/docs/single-ec2-no-google.md new file mode 100644 index 0000000..197c71b --- /dev/null +++ b/docs/single-ec2-no-google.md @@ -0,0 +1,20 @@ +# Single EC2, AP1, no Google + +한 VM의 Docker Compose에 PostgreSQL, Keycloak, Spring API, nginx SPA를 둔다. +외부 진입점만 nginx/TLS proxy로 제한하고 Keycloak 8080, API 8081, PostgreSQL은 +loopback 또는 Docker private network에 둔다. + +```text +Internet :443 -> TLS proxy/SPA + |-> Spring API:8081 +Browser ----------->|-> Keycloak:8080 (public auth path만 proxy) +Keycloak ----------> PostgreSQL:5432 +``` + +이 profile은 Google credential과 tunnel이 필요 없다. EC2 보안 그룹은 22 +(관리 정책에 따른 제한), 80/443만 열고 container 내부 포트를 공개하지 않는다. +backup 대상은 PostgreSQL 데이터와 realm/config/secret이며 Keycloak 개발 +모드 `start-dev`는 production에서 사용하지 않는다. + +`verify-single-ec2-no-google.sh`는 Compose rendering, loopback binding, +AP1 local-identity 계약을 확인한다. diff --git a/scripts/verify-single-ec2-no-google.sh b/scripts/verify-single-ec2-no-google.sh new file mode 100755 index 0000000..9bec1c1 --- /dev/null +++ b/scripts/verify-single-ec2-no-google.sh @@ -0,0 +1,14 @@ +#!/usr/bin/env sh +set -eu + +rendered="$(docker compose config --format json)" +printf '%s\n' "$rendered" | jq -e ' + (.services.keycloak.ports[] | .host_ip == "127.0.0.1" and .target == 8080) + and + (.services.app.ports[] | .host_ip == "127.0.0.1" and .target == 8081) + and + (.networks["keycloak-net"].driver == "bridge") +' >/dev/null + +./scripts/verify-internal-spa-no-google-contract.sh +echo "Single-EC2 local-identity topology verified"