Repository navigation
fix(deploy): keycloak admin paths on their own port, nas ingress without allow-lists (#178) - #182
Merged
Merged
Conversation
…out allow-lists (#178) Keycloak admin paths get their own published port (8444); 8443 refuses them. The published ingress drops Caddy source-address allow-lists that cannot work behind the NAS userland proxy; the NAS per-interface firewall is the control (ADR-0016 R9.6/R9.8 amendment, accepted). Guard tests, smoke probes, the master-realm brute-force identity check and the #132 runbook steps follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keycloak's admin paths move to their own published port (8444), and the published ingress drops the Caddy source-address allow-lists that cannot work behind the NAS runtime's userland proxy. The NAS per-interface firewall becomes the documented control (ADR-0016 R9.6/R9.8 amendment), and #132's runbook carries the firewall rules, the source-address measurement and the refusal checks.
not remote_ipover the internal networks; back-channel routes are unchanged.DECISYA_ADMIN_PORT(8444); both ports are published on the bind address only and fail closed.DECISYA_LAN_SUBNETandDECISYA_WORKSTATION_ADDRESSare retired and refused bycheck. Keycloak getsKC_HOSTNAME_ADMINon the admin port (AppHost model, regenerateddocker-compose.yaml).PUBLISHED_ROUTEStable naming the NAS firewall rule per published route; no admin path reachable on 8443 (case and encoding variants); refused risky path patterns and matchers; a static runbook check; red cases for each rule.verifyonce the bootstrap secret is retired. An Integration test exercises the runbook's ownkcadm.shcommand.Rollback: revert this PR. The merge deploys nothing. On a stack already brought up with this change, restore the two retired keys and drop
DECISYA_ADMIN_PORTin the stack's environment file, remove the NAS firewall rule for the admin port, and redeploy. Master-realm brute-force detection may stay on.Verification (local | CI)
dotnet build -warnaserrordeploy/tests).claudesuite and lintdeploy/tests/stack_smoke.py(live Caddy probes)up(G6)Decisions: the ADR-0016 amendment was accepted by Marco on 2026-10-21. G6 finding F-178-01 (Low: no CI test sends live requests to Caddy) is on #83. G6's condition (run
stack_smoke.pygreen on a Linux Docker host before the firstupon the NAS) is on #132.Packages: none added.
Closes #178
Docs: docs/adr/0016-phase-0-hosting.md, docs/adr/README.md, docs/architecture/nas-ingress-admin-port.md, docs/architecture/deployable-stack.md, docs/architecture/phase-0-hosting.md, docs/runbooks/deployable-stack.md, docs/runbooks/go-live-gate.md, docs/security/threat-models/nas-ingress-admin-port.md, docs/security/reviews/178.md, docs/requirements/phase-0/nas-ingress-admin-port.md, docs/ai/pipeline/178.md
🤖 Generated with Claude Code