pal-e-docs

Review: Switch Keycloak auth URL to auth.landscaping-assistant.app

review-1991-2026-08-02 Review

review ready
Project

Verdict: READY

Re-review after NEEDS_REFINEMENT. All five issues from the first review have been resolved.

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, discovered during App Store resubmission testing 2026-08-02. References board item #1940.
  • [x] Repo — Cross-repo: pal-e-platform (DNS + Caddy), pal-e-deployments (KEYCLOAK_URL env var). Correct repos identified.
  • [x] What Broke — TLS handshake failure on auth.palinks.app, login/registration broken for all public users
  • [x] Repro Steps — 3 steps with curl verification
  • [x] Expected Behavior — auth.landscaping-assistant.app terminates TLS via Hetzner edge proxy, OAuth flow completes
  • [x] Environment — prod / landscaping-assistant, commit 14952b6, Hetzner Caddy at 178.156.129.142
  • [x] File Targets — 3 files with exact line numbers, plus thorough "NOT changing" section with rationale
  • [x] Acceptance Criteria — 6 criteria, all testable
  • [x] Related — project-landscaping-assistant, board items #1940 and #1572
All required bug template sections present. The File Targets and "NOT changing" documentation are excellent scope discipline.

Previous Review Issues — All Resolved

  • [x] Repo section fixed: now correctly names pal-e-platform and pal-e-deployments (was incorrectly saying pal-e-services for edge proxy)
  • [x] KEYCLOAK_URL location clarified: deployment-patch.yaml lines 62-63 and 135-136, verified in codebase
  • [x] File targets added: all 3 files specified with line numbers
  • [x] arch label fixed: now arch:keycloak (was arch:rails-frontend)
  • [x] #1940 dependency documented in Lineage and Related sections

Traceability

  • [x] story:app-store-submission label — "Submit and maintain iOS App Store listing"
  • [x] story note verified — found in project-landscaping-assistant user-stories section
  • [x] arch:keycloak label — Keycloak OIDC authentication
  • [x] arch note verified — arch-keycloak note exists in pal-e-docs (id: 1728)
  • [x] Forgejo issue — ldraney/landscaping-assistant#360, open

File Targets

  • [x] pal-e-platform/terraform/dns.tf — verified: file exists, contains A records for other domains pointing to module.hetzner_edge.server_ipv4. No auth subdomain record exists for landscaping-assistant.app. Pattern for new record is clear from existing entries (lines 12-18).
  • [x] pal-e-platform/salt/pillar/caddy.sls — verified: file exists, contains site entries with domain/proxy_target/www_redirect keys. No auth subdomain entry exists. Proxy target would be keycloak.tail5b443a.ts.net.
  • [x] pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml — verified: lines 62-63 show KEYCLOAK_URL: "https://auth.palinks.app" and lines 135-136 show identical value in second container spec. Both match the issue description exactly.
NOT changing assertions verified:
  • [x] KEYCLOAK_ISSUER at lines 64-65 and 137-138 confirmed as https://keycloak.tail5b443a.ts.net/realms/landscaping
  • [x] KEYCLOAK_ADMIN_URL at lines 66-67 and 139-140 confirmed as Tailnet hostname
  • [x] pal-e-services/terraform/k3s.tfvars redirect URIs — correctly excluded (they point to app callback URL, not auth domain)

Repo Placement

Forgejo issue filed on ldraney/landscaping-assistant but changes are in ldraney/pal-e-platform and ldraney/pal-e-deployments. The issue explicitly acknowledges this cross-repo scope. Since all three changes are tightly coupled (DNS + Caddy + env var must all change together) and landscaping-assistant is the affected service, this placement is acceptable. PRs will use Closes ldraney/landscaping-assistant#360.

Dependencies

  • #1940 [qa] — "Keycloak login/reset redirects to Tailscale URL instead of public domain." Related (same auth domain area) but not blocking. #1940 addresses Keycloak-side redirect URLs; this ticket addresses Rails-side KEYCLOAK_URL + DNS + Caddy routing. Independent fixes.
  • #1572 [done] — Prior issuer mismatch fix. The ticket explicitly guards against regressing this.
  • #1460 [backlog] — Parent custom-domain story work. The apex domain already works; this ticket extends to the auth subdomain.
  • #1463 [done] — Caddy reverse proxy for landscaping-assistant.app. Provides the pattern this ticket follows.
No undocumented dependencies. No blockers.

Acceptance Criteria

6 criteria, all verifiable:
  • AC 1-3: Infrastructure verification (dig, curl, Caddy logs) — agent-verifiable post-apply
  • AC 4: Code change verification (grep deployment-patch.yaml) — agent-verifiable
  • AC 5: End-to-end login from public network — requires browser automation or validate-ui skill
  • AC 6: Regression guard (grep for unchanged KEYCLOAK_ISSUER) — agent-verifiable

Blast Radius

  • auth.palinks.app appears ONLY in landscaping-assistant overlay (deployment-patch.yaml lines 63 and 136). No other apps reference it.
  • Other apps (pal-enterprises, intelligentstaffingsystems) use secretKeyRef for KEYCLOAK_URL, not hardcoded values. No cross-app impact.
  • No auth subdomain pattern exists in DNS or Caddy for any app currently. This will be the first.
  • Minor: secrets.enc.yaml line 11 has an encrypted KEYCLOAK_URL that is unused (deployment-patch overrides with hardcoded value). Cleanup opportunity, not a blocker.

Decomposition Assessment

3 file targets across 2 repos (below threshold). 6 acceptance criteria (marginally above 5-AC threshold), but all changes are mechanically simple: one Terraform resource, one Caddy site entry, two YAML value swaps. Estimated agent work under 5 minutes for code changes. No decomposition needed.

Recommendation

No action needed. All issues from the first review have been resolved. Scope is solid, file targets verified, traceability complete. Ready to move to todo.