Add palinks.app to Rails config.hosts #51
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Type
Feature
Lineage
Related to custom domain setup — palinks.app DNS records are managed by
ldraney/godaddy-tofu.Repo
ldraney/palinksUser Story
As a user visiting palinks.app
I want the Rails app to accept requests with
Host: palinks.appSo that the custom domain works without returning a 403 Blocked Host error
Context
Rails
config.hostsblocks requests from hostnames not in the allowlist, returning a 403. The app currently accepts its Tailscale hostname (palinks.tail5b443a.ts.net) but not the public custom domainpalinks.app. With DNS now pointingpalinks.appat the Hetzner edge proxy (via godaddy-tofu), Rails needs to accept that hostname.Note: Keycloak redirect URI configuration is NOT in scope here. Palinks has no Keycloak integration today — there is no palinks client in the
keycloak_clientsmap inpal-e-services/terraform/k3s.tfvars. Keycloak redirect URI configuration will be added when palinks integrates Keycloak auth (auth-roles story).File Targets
Files the agent should modify:
config/environments/production.rb— addconfig.hosts << "palinks.app"alongside the existing Tailscale hostname entryFiles the agent should NOT touch:
pal-e-services/terraform/k3s.tfvars— no palinks Keycloak client exists; Keycloak scope belongs to the future auth-roles storyFeature Flag
none
Acceptance Criteria
config/environments/production.rbincludes bothpalinks.appand the existing Tailscale hostname (palinks.tail5b443a.ts.net) inconfig.hostsHost: palinks.app(no 403 Blocked Host error)Test Expectations
curl -H "Host: palinks.app" https://palinks.appreturns 200 (after deploy)curl -H "Host: palinks.tail5b443a.ts.net" https://palinks.tail5b443a.ts.netstill returns 200Constraints
config/environments/production.rbfor how the Tailscale hostname is added toconfig.hostsChecklist
Related
pal-e-platform— DNS and infrastructuregodaddy-tofu— DNS record management for palinks.appScope Review: NEEDS_REFINEMENT
Review note:
review-1466-2026-06-14The Keycloak scope in this ticket is premature -- no palinks Keycloak client exists in
k3s.tfvars, and the palinks app has no Keycloak integration (no omniauth/keycloak gems, no auth config). Thekeycloak_clientsmap only contains pal-e-app, pal-enterprises, and landscaping-assistant.Issues found:
[BODY]Remove all Keycloak scope (terraform changes, redirect URI acceptance criteria, checklist items). Keycloak redirect URIs belong with the auth-roles story ticket that creates the palinks Keycloak client.[BODY]Fix Constraints -- "palinks Keycloak client block is around line 16" is wrong (line 16 is the database config, and no Keycloak client exists).[BODY]Update File Targets and Repo to remove pal-e-services -- this becomes a single-repo palinks ticket (production.rb + custom-domain.md only).[BODY]Add Tailscale hostname (palinks.tail5b443a.ts.net) to production config.hosts alongsidepalinks.app.[SCOPE]Missing architecture notearch-palinksin pal-e-docs.Once the Keycloak scope is removed, this is a clean 1-point single-repo ticket (~2 min agent pass).
Add palinks.app to Rails config.hosts and Keycloak redirect URIsto Add palinks.app to Rails config.hostsScope Review: APPROVED
Review note:
review-1466-2026-06-14-v2Re-review after Keycloak scope removal -- ticket is now a clean single-file config change. All template sections present, traceability verified, file target confirmed.
Minor non-blocking notes:
config.hostsis currently commented out in production.rb (no existing Tailscale entry to "add alongside") -- agent should add both hostnames as new lines following the development.rb patternarch-palinksnote missing (tracked separately)