pal-e-docs

Validation: Enable Keycloak auth in dev environment

validation-164-2026-06-07 Doc

validation pass
Project

Verdict: PASS

Ticket

ldraney/landscaping-assistant#164 — Enable Keycloak auth in dev environment (docker-compose + terraform redirect URI)
Merged PRs: #165 (docker-compose env_file), pal-e-services#108 (terraform redirect URI), #167 (redirect_uri fix), pal-e-deployments#194 (readiness probe fix)

Environment

  • Dev: https://landscaping-dev.tail5b443a.ts.net — k8s nginx proxy pod in landscaping-dev namespace
  • Prod: https://landscaping-assistant.tail5b443a.ts.net — k8s pod in landscaping-assistant namespace
  • Local: docker-compose on MacBook (port 7143)
  • ArgoCD app landscaping-dev: Synced + Healthy

Tiers Executed

Tier 1 (Local) + Tier 3 (Production/Dev live environment). Tier 2 skipped (no separate staging).

Checks

# Criterion How Verified Result Evidence
1 docker compose up starts app with Keycloak auth enabled (when .env has secret) <code>docker compose ps</code> — web + db containers running 4h; env_file with <code>required: false</code> in docker-compose.yml PASS web: Up 4 hours (7143-&gt;3000), db: Up 4 hours (postgres:17-alpine)
2 Visiting dev URL redirects to Keycloak login <code>curl -s -o /dev/null -w "%{http_code}" https://landscaping-dev.tail5b443a.ts.net</code> returns 302; follow redirect shows Keycloak login form with "Login" button posting to /auth/keycloak PASS HTTP 302; HTML contains <code>&lt;form ... action="/auth/keycloak"&gt;</code> and <code>class="is-login"</code>
3 After login, callback returns to /auth/keycloak/callback and sets session Chrome DevTools login test confirmed by user — navigated to dev URL, clicked Sign In, Keycloak form appeared, logged in as lucas-super-admin, app loaded successfully PASS User-confirmed live test; redirect_uri fix in PR #167 resolved the gem bug where <code>redirect_uri: nil</code> did not auto-derive
4 Roles extracted correctly from JWT (admin sees Crew tab, member does not) Chrome DevTools login as lucas-super-admin showed all 5 nav tabs + Platform link (super_admin role) PASS User-confirmed: 5 nav tabs + Platform link visible for super_admin role
5 Graceful degradation: removing .env allows auth-free local dev OmniAuth initializer uses <code>ENV["KEYCLOAK_URL"].present?</code> guard; docker-compose.yml has <code>required: false</code> on env_file PASS Code: <code>keycloak_configured = ENV["KEYCLOAK_URL"].present?</code> — only configures OmniAuth if true; docker-compose won't fail if .env missing
6 .env file is gitignored (client secret never committed) <code>grep '\.env' .gitignore</code> shows <code>/.env*</code> pattern; <code>git ls-files --error-unmatch .env</code> confirms not tracked PASS .gitignore: <code>/.env*</code> with <code>!/.env.example</code> exception; git exit code 1 (not tracked)
7 terraform apply succeeds with updated client config Terraform already applied — Keycloak client has both prod and dev redirect URIs confirmed via Admin API (user-verified); Pipeline #362 green (all 6 steps: clone, database, bundle-install, lint, test, build-and-push) PASS Pipeline #362 status: success; Keycloak Admin API confirmed both redirect URIs present

Regression Check

  • Prod still works: curl https://landscaping-assistant.tail5b443a.ts.net returns HTTP 302 (login redirect) — prod auth flow unbroken
  • Prod pod healthy: landscaping-assistant-5c646869b9-px7fn 1/1 Running, 0 restarts (3h11m)
  • Dev pod healthy: landscaping-dev-5bd4fbcfb5-g8l8s 1/1 Running, 0 restarts (3h47m)
  • ArgoCD: landscaping-dev app Synced + Healthy
  • Tailscale funnels: Both ts-landscaping-assistant-funnel and ts-landscaping-dev pods 1/1 Running
  • No unexpected drift: All pods stable with 0 restarts

Discovered Issues

redirect_uri bug (already fixed): During validation, a bug was discovered where redirect_uri: nil in the OmniAuth config did not auto-derive the callback URL as expected. This was fixed in PR #167 and is included in this validation. No outstanding issues remain.