Keycloak: prediction-assistant
Keycloak Configuration
Keycloak realm and client setup for kalshi-assistant. Follows pal-e-platform and pal-e-services patterns. Answers: how is the identity provider configured?
Diagram
Components
| Component | Purpose | Notes |
|---|---|---|
| Realm: kalshi-assistant | Identity boundary for the app's users | Separate realm per app. Follows pal-e-platform convention. |
| Client: kalshi-assistant-app | OAuth2 client for the iOS app | Direct grant enabled. Public client (no client secret for mobile). |
| Custom Login Theme | Branded login page for kalshi-assistant | Located at keycloak/themes/kalshi-assistant/ in pal-e-platform |
| Terraform Keycloak Provider | IaC provisioning of realm and client | Configured in pal-e-services k3s.tfvars |
| pal-e-platform themes dir | Theme source files deployed to Keycloak | keycloak/themes/{app-name}/login/ |
| pal-e-services tfvars | Realm and client configuration as code | k3s.tfvars defines realm name, client ID, grant types |
Key Decisions
- Follows landscaping-assistant pattern — Realm and client setup mirrors the existing landscaping-assistant Keycloak configuration in pal-e-platform and pal-e-services. Proven pattern, no new infrastructure decisions.
- Theme at keycloak/themes/{app-name}/ — Custom login page branded for kalshi-assistant. Theme files live in pal-e-platform repo, deployed as part of the Keycloak container image.
- Terraform-managed configuration — Realm and client provisioned via Terraform Keycloak provider in pal-e-services. Configuration lives in k3s.tfvars alongside other app realms. No manual Keycloak admin console changes.
- Direct grant for mobile — Public client with Resource Owner Password Credentials grant type. No browser redirect. The iOS app collects username/password and exchanges directly for tokens.
- Separate realm per app — kalshi-assistant gets its own realm, not a shared one. Users are app-specific. Follows the one-realm-per-app convention across pal-e projects.