From 42957abfed3c8da296b74c2e1a54a248a9af1438 Mon Sep 17 00:00:00 2001
From: donghyeon-ka <ehdgus6435@kumoh.ac.kr>
Date: Sat, 25 Jul 2026 16:41:27 +0900
Subject: [PATCH] docs: define single-EC2 Google federation deployment

---
 docs/single-ec2-google-federation.md        | 20 ++++++++++++++++++++
 scripts/verify-single-ec2-google-profile.sh |  8 ++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 docs/single-ec2-google-federation.md
 create mode 100755 scripts/verify-single-ec2-google-profile.sh

diff --git a/docs/single-ec2-google-federation.md b/docs/single-ec2-google-federation.md
new file mode 100644
index 0000000..8abb17e
--- /dev/null
+++ b/docs/single-ec2-google-federation.md
@@ -0,0 +1,20 @@
+# Single EC2 with Google federation
+
+local-identity single-EC2 topology에 다음 네 요소가 추가된다.
+
+1. 고정 public HTTPS hostname
+2. trusted TLS/reverse proxy와 Keycloak public hostname
+3. Google OAuth client의 exact broker callback
+4. Keycloak Google IdP secret과 safe First Broker Login policy
+
+학습 profile은 Cloudflare named tunnel을 사용할 수 있어 EC2 inbound에
+Keycloak 8080을 열지 않는다. containerized cloudflared의 origin은
+`127.0.0.1`이 아니라 Compose service DNS의 reverse proxy다.
+
+실제 Google secret은 `.env`/secret store에만 두며 realm export나 Git에
+포함하지 않는다. credential이 없는 CI는 mock OIDC realm으로 broker 계약을
+검증하고, 실제 Google callback은 사용자 소유 credential/domain 환경에서
+별도 실행한다.
+
+`verify-single-ec2-google-profile.sh`는 tunnel, proxy headers, redirect URI,
+broker realm 계약을 묶어 검증한다.
diff --git a/scripts/verify-single-ec2-google-profile.sh b/scripts/verify-single-ec2-google-profile.sh
new file mode 100755
index 0000000..d5201a3
--- /dev/null
+++ b/scripts/verify-single-ec2-google-profile.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+set -eu
+
+./scripts/verify-public-tunnel-config.sh
+./scripts/verify-reverse-proxy-headers.sh
+./scripts/verify-google-redirect-uri-policy.sh
+./scripts/verify-google-broker-config.sh
+echo "Single-EC2 Google federation deployment profile verified"