pal-e-docs
Project not found.

Review: Apply Keycloak frontendUrl for landscaping realm via IaC

review-2000-2026-08-03 Review

review ready
Project

Verdict: READY

Note: Both READY and APPROVED are accepted as passing verdicts by the check-board-advance hook. Use either keyword interchangeably.

Template Completeness

Issue type: Bug (template-issue-bug). All required sections present:
  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] What Broke
  • [x] Repro Steps
  • [x] Expected Behavior
  • [x] Environment
  • [x] Acceptance Criteria
  • [x] Related

Traceability

  • [x] story:app-store-submission label — "Submit and maintain iOS App Store listing"
  • [x] story note verified — found in project-landscaping-assistant user-stories table
  • [x] arch:keycloak label — Keycloak authentication component
  • [x] arch note verified — arch-keycloak note exists in pal-e-docs (id 1728, doc type, active)
  • [x] Forgejo issue — ldraney/pal-e-services#208, open

File Targets

  • [x] terraform/k3s.tfvars (symlink to ~/secrets/pal-e-services/k3s.tfvars) — verified: landscaping realm exists at lines 102-118, confirmed attributes field is absent (0 occurrences in file)
  • [x] terraform/keycloak.tf — verified: attributes = each.value.attributes already present (added by PR #207, commit dbed215)
  • [x] terraform/variables.tf — verified: attributes = optional(map(string), {}) already defined (added by PR #207)
IaC support is in place. Only the tfvars config value needs to be set.

Repo Placement

OK. Issue filed on ldraney/pal-e-services, fix is in the same repo (k3s.tfvars + tofu apply). No cross-repo changes needed.

Dependencies

Related board items on board-landscaping-assistant:
  • #1940 (qa): "Keycloak login/reset redirects to Tailscale URL instead of public domain" — downstream symptom of same root cause. This fix resolves the persistence risk for that item.
  • #1991 (qa): "Switch Keycloak auth URL to auth.landscaping-assistant.app" — related Keycloak URL alignment work.
  • #1983 (qa): same story (app-store-submission) + arch:keycloak — related submission work.
  • #1927 (validation): arch:keycloak + story:account-email — Keycloak email flow, indirectly affected if frontendUrl is lost on restart.
No hard blockers identified. This ticket can proceed independently.

Acceptance Criteria

3 criteria, all verifiable by an agent:
  • AC1: k3s.tfvars updated with attributes = { frontendUrl = "https://auth.landscaping-assistant.app" } — verifiable via file read
  • AC2: tofu apply run successfully — verifiable via exit code and output
  • AC3: Discovery doc at auth.landscaping-assistant.app returns correct URLs — verifiable via curl
Note: k3s.tfvars is a gitignored secrets file (symlink). This is an operational config change, not a PR-able code change. The agent will edit the secret directly and run tofu apply.

Blast Radius

Low risk. The attributes variable defaults to {}, so adding it to one realm does not affect other realms. However, other production realms with public domains (ISS at intelligentstaffingsystems.ai, prediction-assistant) may eventually need the same frontendUrl treatment. That is out of scope for this ticket.

Decomposition Assessment

1 file target, 3 acceptance criteria, estimated agent time <5 minutes. No decomposition needed.

Recommendation

No action needed. Scope is solid, traceability complete, file targets verified, and the work fits comfortably in a single agent pass.