pal-e-docs

Review: Switch Keycloak auth URL to auth.landscaping-assistant.app

review-1991-2026-08-02-v2 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, related to #1940
  • [x] Repo — Cross-repo listed (but incomplete, see below)
  • [x] What Broke — Clear symptoms with curl evidence
  • [x] Repro Steps — Concrete 3-step repro
  • [x] Expected Behavior — Clear target state
  • [x] Environment — Cluster, commit, edge proxy identified
  • [x] File Targets — Present (has inaccuracies, see below)
  • [x] Acceptance Criteria — 6 criteria listed
  • [x] Related — Project and related board item referenced
All required bug template sections present.

Traceability

  • [x] story:app-store-submission label — found in project-landscaping-assistant user-stories table
  • [x] story note verified — entry exists in project-landscaping-assistant user-stories section
  • [x] arch:keycloak label — Keycloak authentication component
  • [x] arch note verified — arch-keycloak note exists in pal-e-docs (id: 1728)
  • [x] Forgejo issue — ldraney/landscaping-assistant#360, state: open

File Targets

  • [x] pal-e-platform/terraform/dns.tf — verified: file exists, has landscaping-assistant.app root A record (line 12-18) but no auth subdomain record. Adding auth A record is correct.
  • [x] pal-e-platform/salt/pillar/caddy.sls — verified: file exists, has landscaping-assistant.app site entry (lines 17-20) but no auth subdomain entry. Adding auth site is correct.
  • [x] pal-e-services/terraform/k3s.tfvars — verified: file exists (symlink to secrets). Landscaping-assistant client config starts at line 204. ISSUE: ticket says to add https://auth.landscaping-assistant.app/* to redirect URIs and web origins (lines 214-230), but redirect URIs are for app callbacks (where Keycloak sends users AFTER auth), not for Keycloak's own frontend URL. Adding Keycloak's own domain as a redirect URI is incorrect for standard OAuth. Clarify what Keycloak config change is actually needed (likely realm frontend URL or server config, not client redirect URIs).
  • [ ] pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml — MISSING from ticket. This file contains the hardcoded KEYCLOAK_URL: "https://auth.palinks.app" at lines 62-63 (init container) and lines 135-136 (app container). This is where the env var actually lives.
  • [ ] KEYCLOAK_ISSUER concern — same file, lines 64-65 and 137-138, set to https://keycloak.tail5b443a.ts.net/realms/landscaping. Board item #1572 (done) fixed an issuer mismatch with auth.palinks.app previously. Changing the auth domain may resurface the issuer mismatch. Ticket should state whether KEYCLOAK_ISSUER also changes or explain why it stays.

Repo Placement

Issue filed on ldraney/landscaping-assistant. Ticket correctly identifies this as cross-repo and lists pal-e-platform, pal-e-services, and landscaping-assistant. However, pal-e-deployments is missing from the Repo section. The KEYCLOAK_URL env var is hardcoded in pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml (lines 62-63, 135-136), not "not git-tracked" as the ticket claims. The landscaping-assistant repo itself has no fix files — only pal-e-platform, pal-e-services, and pal-e-deployments need changes.

Dependencies

  • Board item #1940 ("Bug: Keycloak login/reset redirects to Tailscale URL instead of public domain") — in QA column. Same root cause (wrong auth domain). Ticket documents this relationship. Not a blocker but changes should be coordinated.
  • Board item #1572 ("Bug: Keycloak issuer mismatch blocks login via auth.palinks.app") — done. Established the KEYCLOAK_ISSUER pattern. Relevant precedent for the issuer concern above.

Acceptance Criteria

6 criteria, all agent-verifiable via CLI commands (dig, curl, kubectl, grep). Missing criterion: ticket should verify KEYCLOAK_ISSUER still works after the domain switch (or is updated). Otherwise solid and testable.

Blast Radius

  • auth.palinks.app appears ONLY in pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml (2 occurrences). No other apps reference it.
  • The landscaping-assistant app code reads KEYCLOAK_URL from ENV in sessions_controller.rb, application_controller.rb, and keycloak_admin_service.rb — all read-only, no hardcoded URLs. Changing the env var value is sufficient for the app.
  • No staging impact — staging uses Tailscale URLs, not auth.palinks.app.
  • The encrypted secrets.enc.yaml also contains a KEYCLOAK_URL entry but the plain value in deployment-patch.yaml takes precedence.

Decomposition Assessment

4+ file targets across 3 repos (pal-e-platform, pal-e-services, pal-e-deployments). 6 acceptance criteria. Estimated agent work: borderline on 5-minute rule due to cross-repo nature (DNS + Caddy + Keycloak + deployment). However, per project convention, no decomposition — keep unified and discuss sequencing after review.

Recommendation

  • [BODY] Add pal-e-deployments to the ### Repo section.
  • [BODY] Replace the "Deployment (pal-e-services or pal-e-deployments)" file target with: pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml lines 62-63 and 135-136. Remove the claim that KEYCLOAK_URL is "not git-tracked".
  • [BODY] Clarify the k3s.tfvars change — redirect URIs are for app callbacks, not Keycloak's own frontend URL. If the intent is to configure Keycloak's frontend URL or issuer to use auth.landscaping-assistant.app, specify the correct Terraform resource/setting.
  • [BODY] Address whether KEYCLOAK_ISSUER (currently https://keycloak.tail5b443a.ts.net/realms/landscaping) needs updating. Board item #1572 (done) established this pattern — changing the auth domain may break token validation if the issuer doesn't match.