[Ch 7] Services wiring — Keycloak realm and OIDC client #17

New issue

Open

opened 2026-08-01 19:03:01 +00:00 by ldraney · 1 comment

ldraney commented

2026-08-01 19:03:01 +00:00

Owner

Type

Feature

Lineage

Standalone — scoped from platform-playbook chapter 7 for the full-stack mdview vision.

Repo

ldraney/pal-e-services, ldraney/pal-e-deployments

User Story

As a developer
I want a Keycloak realm and OIDC client for mdview
So that users can authenticate via SSO and generate API tokens

Context

mdview has no auth. The full-stack vision requires Keycloak SSO so users can log in and generate API tokens for CLI access. This ticket creates the realm and client in Terraform. The app-side auth wiring comes in Ch 11 (integration).

File Targets

pal-e-services/terraform/keycloak.tf — add mdview to keycloak_realms variable
pal-e-deployments/overlays/mdview/prod/secrets.enc.yaml — add KEYCLOAK_* env vars

Files the agent should NOT touch:

ldraney/mdview/app/ — app-side auth is Ch 11

Feature Flag

none

Acceptance Criteria

Keycloak realm mdview exists with registration enabled
OIDC client mdview with PKCE (S256) + standard flow
Redirect URIs include https://mdview.tail5b443a.ts.net/auth/keycloak/callback
KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, KEYCLOAK_CLIENT_SECRET in deployment secrets

Test Expectations

No app-level tests — infra provisioning
Run command: tofu plan in pal-e-services shows Keycloak resources

Constraints

Follow existing realm pattern from landscaping-assistant in keycloak.tf
Realm roles: admin (just Lucas for beta)

Checklist

PR opened
Tests pass
No unrelated changes

project-mdview — project this affects

### Type Feature ### Lineage Standalone — scoped from platform-playbook chapter 7 for the full-stack mdview vision. ### Repo `ldraney/pal-e-services`, `ldraney/pal-e-deployments` ### User Story As a developer I want a Keycloak realm and OIDC client for mdview So that users can authenticate via SSO and generate API tokens ### Context mdview has no auth. The full-stack vision requires Keycloak SSO so users can log in and generate API tokens for CLI access. This ticket creates the realm and client in Terraform. The app-side auth wiring comes in Ch 11 (integration). ### File Targets - `pal-e-services/terraform/keycloak.tf` — add `mdview` to `keycloak_realms` variable - `pal-e-deployments/overlays/mdview/prod/secrets.enc.yaml` — add KEYCLOAK_* env vars Files the agent should NOT touch: - `ldraney/mdview/app/` — app-side auth is Ch 11 ### Feature Flag none ### Acceptance Criteria - [ ] Keycloak realm `mdview` exists with registration enabled - [ ] OIDC client `mdview` with PKCE (S256) + standard flow - [ ] Redirect URIs include `https://mdview.tail5b443a.ts.net/auth/keycloak/callback` - [ ] KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, KEYCLOAK_CLIENT_SECRET in deployment secrets ### Test Expectations - [ ] No app-level tests — infra provisioning - Run command: `tofu plan` in pal-e-services shows Keycloak resources ### Constraints - Follow existing realm pattern from landscaping-assistant in keycloak.tf - Realm roles: admin (just Lucas for beta) ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-mdview` — project this affects

ldraney added the

phase:1

label

2026-08-01 20:21:13 +00:00

ldraney commented

2026-08-01 20:25:02 +00:00

Author

Owner

Scope Review: NEEDS_REFINEMENT

Review note: review-1948-2026-08-01
File targets and repo placement need correction before this ticket is agent-ready.

[SCOPE] arch-mdview-infra note does not exist in pal-e-docs (404) — needs creation (affects 5 board items)
[BODY] File target keycloak.tf is the resource definitions, not where values are set — should reference the tfvars file for keycloak_realms and keycloak_clients entries
[BODY] secrets.enc.yaml does not exist yet — should say "create" not "add"
[BODY] Missing file target: overlays/mdview/prod/kustomization.yaml needs update to reference secrets
[BODY] Missing file target for keycloak_clients variable entry (AC requires OIDC client)
[BODY] Consider adding KEYCLOAK_ISSUER to AC #4 (present in landscaping-assistant pattern)
[BODY] Repo placement: issue filed on mdview but all work is in pal-e-services and pal-e-deployments
[BODY] Dependencies undocumented: Ch 11 (item #1951) depends on this ticket

## Scope Review: NEEDS_REFINEMENT Review note: `review-1948-2026-08-01` File targets and repo placement need correction before this ticket is agent-ready. - **[SCOPE]** `arch-mdview-infra` note does not exist in pal-e-docs (404) — needs creation (affects 5 board items) - **[BODY]** File target `keycloak.tf` is the resource definitions, not where values are set — should reference the tfvars file for `keycloak_realms` and `keycloak_clients` entries - **[BODY]** `secrets.enc.yaml` does not exist yet — should say "create" not "add" - **[BODY]** Missing file target: `overlays/mdview/prod/kustomization.yaml` needs update to reference secrets - **[BODY]** Missing file target for `keycloak_clients` variable entry (AC requires OIDC client) - **[BODY]** Consider adding KEYCLOAK_ISSUER to AC #4 (present in landscaping-assistant pattern) - **[BODY]** Repo placement: issue filed on mdview but all work is in pal-e-services and pal-e-deployments - **[BODY]** Dependencies undocumented: Ch 11 (item #1951) depends on this ticket