pal-e-docs

Validation: ISS realm config — login_theme + verify_email

validation-184-2026-07-17 Doc

validation pass
Project

Verdict: PASS

Ticket

ldraney/pal-e-services#184 — Set login_theme = "iss" and verify_email = true on the ISS Keycloak realm, with variable wiring through variables.tf and keycloak.tf.
Merged PR: #187 (commit a64f29a, merged 2026-07-17)

Environment

Production k3s cluster (archbox). Keycloak namespace: keycloak. Pod: keycloak-d78ffb987-7hcpz (1/1 Running, 0 restarts). Terraform workspace: k3s via ~/pal-e-services/terraform.

Checks

# Criterion How Verified Result Evidence
1 <code>login_theme = "iss"</code> set on ISS realm in <code>k3s.tfvars</code> <code>grep</code> on <code>k3s.tfvars</code> line 104 PASS <code>login_theme = "iss"</code> confirmed at line 104 inside the <code>iss = {}</code> block (lines 98-115)
2 <code>verify_email = true</code> set on ISS realm in <code>k3s.tfvars</code> <code>grep</code> on <code>k3s.tfvars</code> line 103 PASS <code>verify_email = true</code> confirmed at line 103 inside the <code>iss = {}</code> block
3 Keycloak login page renders with ISS theme after apply <code>curl</code> ISS login page, inspect HTML for theme resource paths PASS Login page loads CSS from <code>/resources/.../login/iss/css/login.css</code>, JS from <code>/login/iss/js/</code>, favicon from <code>/login/iss/img/favicon.ico</code>. Title: "Sign in to Intelligence Staffing Systems". Registration link present.
4 New registrations receive email verification <code>kcadm get realms/iss</code> for <code>verifyEmail</code> + SMTP config PASS <code>verifyEmail = true</code> confirmed in live Keycloak. SMTP configured: Postmark (<code>smtp.postmarkapp.com:587</code>), from <code>noreply@intelligentstaffingsystems.ai</code>, STARTTLS enabled, basic auth active.

Terraform State

Note: tofu apply had not been run after the merge. The CI push pipeline (#234) ran tofu plan/validate only. Applied manually during this validation session.
  • Pre-apply plan: keycloak_realm.this["iss"] — + login_theme = "iss", ~ verify_email = false -> true
  • Apply result: Apply complete! Resources: 0 added, 3 changed, 0 destroyed.
  • Post-apply plan: No changes. Your infrastructure matches the configuration.

Regression Check

  • Keycloak pod healthy: 1/1 Running, 0 restarts
  • All 9 realms enabled and accessible
  • Other realm login themes unchanged: westside-basketball=westside, landscaping=landscaping
  • verify_email defaults to false in variables.tf — no impact on existing realms (all show verifyEmail: false except ISS)
  • tofu plan clean after apply — no unexpected drift

Discovered Issues

  • Local working tree in ~/pal-e-services had uncommitted changes removing verify_email wiring from keycloak.tf and variables.tf. Pre-existing local state (stashed changes from other work), not a regression.
  • Woodpecker push pipeline does not run tofu apply automatically — apply required manual execution. Known gap per project memory.