Validation: Fix TLS cert for dev.intelligentstaffingsystems.ai + deploy register.ftl to Keycloak configmap
Verdict: PASS
Ticket
ldraney/intelligentstaffingsystems#98 — Fix TLS cert for dev.intelligentstaffingsystems.ai + deploy register.ftl to Keycloak configmap
Merged PRs: ldraney/pal-e-platform#552 (caddy fix + register.ftl), ldraney/pal-e-platform#553 (pipeline git fix)
Environment
Production cluster. Edge proxy at 178.156.129.142 (Caddy via SaltStack). Keycloak namespace on k3s cluster. Domain: dev.intelligentstaffingsystems.ai. Keycloak: keycloak.tail5b443a.ts.net/realms/iss
Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | TLS cert working for dev.intelligentstaffingsystems.ai (valid cert, no TLS errors) | curl -vI https://dev.intelligentstaffingsystems.ai; openssl s_client -servername dev.intelligentstaffingsystems.ai -connect 178.156.129.142:443 | PASS | TLS handshake succeeds (TLSv1.3 / TLS_AES_128_GCM_SHA256). Valid Let's Encrypt certificate: subject=CN=dev.intelligentstaffingsystems.ai, issuer=C=US O=Let's Encrypt CN=YE2, notBefore=Jul 19 13:11:27 2026 GMT, notAfter=Oct 17 13:11:26 2026 GMT. SAN matches. OpenSSL verify result: 0. Previous failure was "TLS alert, internal error (592)" with no peer certificate — now fully resolved after pipeline #1649 applied the salt highstate with git installed. |
| 2 | Registration template deployed: Keycloak registration page renders with phone field and ISS branding | kubectl get configmap keycloak-iss-theme -n keycloak -o jsonpath='{.data.register\.ftl}' | PASS | ConfigMap contains register.ftl with phone field (user.attributes.phone, type=tel), ISS theme (register.css), kc-register-form, firstName/lastName/email/password fields. Confirmed present and unchanged from prior validation. |
Regression Check
Production domain intelligentstaffingsystems.ai: HTTP 200, TLS working (valid cert, H2). No regressions detected on existing services.
Discovered Issues
HTTP 502 from dev.intelligentstaffingsystems.ai. TLS terminates correctly but Caddy returns 502 Bad Gateway — the upstream backend (dev ISS Rails app) is not reachable. This is NOT a TLS issue and is outside the scope of this ticket. The dev environment backend deployment is tracked separately (the dev Rails pod needs to be running for the full page to load). No new Forgejo issue created as this is expected state — the dev environment backend depends on the kustomize overlay being deployed.
History
2026-07-18: Initial validation — PARTIAL (register.ftl PASS, TLS FAIL due to salt apply silently skipped without git).
2026-07-19: Re-validation after pipeline #1649 succeeded (git installed, salt highstate applied) — TLS PASS. Verdict upgraded to PASS.
2026-07-19: Re-validation after pipeline #1649 succeeded (git installed, salt highstate applied) — TLS PASS. Verdict upgraded to PASS.