pal-e-docs

Review: Codify Keycloak public ingress IaC

review-1482-2026-06-17 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- present, references #453 and godaddy-tofu#36
  • [x] Repo -- ldraney/pal-e-platform
  • [x] User Story -- present, well-written
  • [x] Context -- thorough, explains experimental verification and manual patches
  • [x] File Targets -- 3 targets specified with line numbers
  • [x] Feature Flag -- "None" (appropriate for IaC change)
  • [x] Acceptance Criteria -- 5 criteria
  • [x] Test Expectations -- 2 items
  • [x] Constraints -- 3 constraints documented
  • [x] Checklist -- present
  • [x] Related -- 3 references
All required sections for the Feature template are present.

Traceability

  • [x] story:custom-domains label -- present on board item
  • [ ] story note MISSING -- [SCOPE] The user stories table on project-pal-e-platform does not contain a story:custom-domains entry. Create user story entry on project-pal-e-platform user-stories section.
  • [x] arch:keycloak label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No arch-keycloak note found in pal-e-docs. Create architecture note arch-keycloak for component keycloak.
  • [x] arch:edge-proxy label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No arch-edge-proxy note found in pal-e-docs. Create architecture note arch-edge-proxy for component edge-proxy.
  • [x] Forgejo issue -- ldraney/pal-e-platform#454, open

File Targets

  • [x] terraform/dns.tf -- verified: file exists, contains existing A records for palinks.app and landscaping-assistant.app using module.hetzner_edge.server_ipv4. New auth record follows established pattern.
  • [x] terraform/modules/keycloak/main.tf -- verified: KC_HOSTNAME env block is at lines 132-135 exactly as stated. Block sets KC_HOSTNAME = keycloak.${var.tailscale_domain}.
  • [x] salt/pillar/caddy.sls -- verified: file exists with existing site entries for palinks and landscaping. New auth entry follows established pattern.

Repo Placement

Correct. All three file targets are in ldraney/pal-e-platform and the issue is filed there. The Related section mentions pal-e-services#120 as a "companion IaC changes" item, which is appropriately tracked as a separate issue.

Dependencies

  • pal-e-platform#453 (board item #1480) -- CI pipeline. Currently in backlog column. Issue state is "open" but title has "CLOSED:" prefix, suggesting ambiguous status. This is a declared blocker ("Depends on pal-e-platform#453") and the issue body says "this PR should be the first real change to flow through the new plan-on-PR / apply-on-merge pipeline." The dependency must be resolved before this ticket can move to next_up.
  • Board item #1483 ("Update KEYCLOAK_URL for landscaping-assistant") shares the story:custom-domains label and arch:keycloak. This is likely a downstream item that should be sequenced after #1482.
  • godaddy-tofu#36 -- documentation, referenced as related (not blocking).

Acceptance Criteria

5 acceptance criteria, all verifiable by an agent:
  • tofu plan output -- verifiable via CLI
  • tofu apply success -- verifiable via CLI
  • salt state.apply caddy -- verifiable via SSH to edge-proxy
  • OIDC discovery on auth.palinks.app -- verifiable via curl
  • OIDC discovery on keycloak.tail5b443a.ts.net -- verifiable via curl
Criteria are well-specified and testable. Note: criteria 3 (salt state.apply) requires SSH access to the edge-proxy, which is a post-merge manual step per the Constraints section. This is acceptable for IaC work.

Blast Radius

  • KC_HOSTNAME is referenced only once (terraform/modules/keycloak/main.tf:133). Removal is safe from a code standpoint.
  • Removing KC_HOSTNAME changes Keycloak's issuer URL behavior. Any service using hardcoded keycloak.tail5b443a.ts.net as issuer will continue working (AC #5 verifies this). Services using the public URL will need their KEYCLOAK_URL updated -- this is tracked by sibling ticket #1483.
  • No existing references to auth.palinks.app in either pal-e-platform or godaddy-tofu repos, confirming this is net-new configuration.

Decomposition Assessment

3 file targets in 1 repo. 5 acceptance criteria. Estimated agent work: ~3-4 minutes (straightforward IaC additions following existing patterns). No decomposition needed.

Recommendations

  • [SCOPE] Create story:custom-domains user story entry on project-pal-e-platform user-stories section.
  • [SCOPE] Create architecture note arch-keycloak for component keycloak.
  • [SCOPE] Create architecture note arch-edge-proxy for component edge-proxy.
  • [SCOPE] Resolve dependency on pal-e-platform#453 (board item #1480): clarify whether it is actually complete (title says "CLOSED:" but state is open and board column is backlog). If complete, close the issue and move board item to done. If not, this ticket is blocked.