Playground: Protect behind Keycloak + point at pal-e-docs-app

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ldraney/pal-e-platform#343

forgejo_admin commented

2026-05-05 04:07:31 +00:00

Contributor

Type

Feature

Lineage

Standalone — scoped during platform SSO initiative (2026-05-04). Depends on platform realm and SSO being functional.

Repo

forgejo_admin/pal-e-deployments

User Story

As a platform admin
I want my playground protected behind Keycloak login and configured to serve the pal-e-docs-app for development
So that my development environment is secure and I can iterate on the docs frontend

Context

Currently playground.tail5b443a.ts.net and svelte-playground.tail5b443a.ts.net are public (no auth). They should be behind Keycloak (platform realm) since they contain internal development work. Additionally, the svelte-playground deployment should be re-pointed to serve the new pal-e-docs-app SvelteKit project for frontend development of the documentation system.

File Targets

Files the agent should modify or create:

overlays/playground/prod/ — add oauth2-proxy sidecar or Keycloak gating
overlays/svelte-playground/prod/ — re-point to pal-e-docs-app source

Files the agent should NOT touch:

The playground source repos themselves (just the k8s deployment config)

Acceptance Criteria

playground.tail5b443a.ts.net requires Keycloak login
svelte-playground.tail5b443a.ts.net requires Keycloak login
svelte-playground serves pal-e-docs-app (or new dedicated overlay)
Authenticated users see content normally after login
SSO session from pal-e-admin carries over (no re-login)

Test Expectations

Unauthenticated curl to playground returns 302 to Keycloak
Authenticated access shows playground content
Run command: curl -s -o /dev/null -w "%{http_code}" https://playground.tail5b443a.ts.net/

Constraints

Use same Keycloak platform realm (SSO session sharing)
Don't break the playground content — just add auth layer
Consider oauth2-proxy as sidecar for static sites that can't do OIDC natively

Checklist

PR opened
Tests pass
No unrelated changes

project-pal-e-platform — platform project
project-frontend-playground — playground project

### Type Feature ### Lineage Standalone — scoped during platform SSO initiative (2026-05-04). Depends on platform realm and SSO being functional. ### Repo `forgejo_admin/pal-e-deployments` ### User Story As a platform admin I want my playground protected behind Keycloak login and configured to serve the pal-e-docs-app for development So that my development environment is secure and I can iterate on the docs frontend ### Context Currently `playground.tail5b443a.ts.net` and `svelte-playground.tail5b443a.ts.net` are public (no auth). They should be behind Keycloak (platform realm) since they contain internal development work. Additionally, the svelte-playground deployment should be re-pointed to serve the new pal-e-docs-app SvelteKit project for frontend development of the documentation system. ### File Targets Files the agent should modify or create: - `overlays/playground/prod/` — add oauth2-proxy sidecar or Keycloak gating - `overlays/svelte-playground/prod/` — re-point to pal-e-docs-app source Files the agent should NOT touch: - The playground source repos themselves (just the k8s deployment config) ### Acceptance Criteria - [ ] `playground.tail5b443a.ts.net` requires Keycloak login - [ ] `svelte-playground.tail5b443a.ts.net` requires Keycloak login - [ ] svelte-playground serves pal-e-docs-app (or new dedicated overlay) - [ ] Authenticated users see content normally after login - [ ] SSO session from pal-e-admin carries over (no re-login) ### Test Expectations - [ ] Unauthenticated curl to playground returns 302 to Keycloak - [ ] Authenticated access shows playground content - Run command: `curl -s -o /dev/null -w "%{http_code}" https://playground.tail5b443a.ts.net/` ### Constraints - Use same Keycloak platform realm (SSO session sharing) - Don't break the playground content — just add auth layer - Consider oauth2-proxy as sidecar for static sites that can't do OIDC natively ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-pal-e-platform` — platform project - `project-frontend-playground` — playground project

forgejo_admin closed this issue

2026-05-06 03:30:37 +00:00

Rows
Columns

Playground: Protect behind Keycloak + point at pal-e-docs-app #343