titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

WIP: keycloak: rerun Hermes OIDC ensure for chat/triage hostname rollout #36

Closed
hermes-automation wants to merge 1 commits from fix/hermes-oidc-ensure-rerun-hostname-rollout into main
pull from: fix/hermes-oidc-ensure-rerun-hostname-rollout
merge into: titan:main
Conversation 0 Commits 1 Files Changed 1 +1 -1
hermes-automation commented 2026-08-21 08:40:06 +00:00
Member
Copy Link

POST-MERGE FOLLOW-UP for PR #34 (chat/triage hostname rename, merged as 8ace4d47).

Problem: the renamed hosts chat.bstein.dev and triage.bstein.dev serve TLS and route correctly, but login fails: Keycloak returns HTTP 400 "Invalid parameter: redirect_uri" because clients hermes-chat-proxy and hermes-triage-proxy still carry the pre-rename redirect URIs. The ensure Job (hermes-access-oidc-client-ensure-10) last ran before #34 changed hermes_access_oidc_ensure.sh.

Fix: bump the Job name to ensure-11 so Flux recreates the immutable Job and reruns the script, which PUTs the new redirect_uri, webOrigins, rootUrl and post-logout values. Same convention as ensure-7..ensure-10.

Verification after merge: Job completes in sso namespace; then GET https://chat.bstein.dev/ and https://triage.bstein.dev/ -> 302 to sso.bstein.dev -> Keycloak login form renders (no Invalid parameter error). Users must log in again because oauth2-proxy cookies are host-bound.

No secrets are printed; the script only writes them to Vault.

POST-MERGE FOLLOW-UP for PR #34 (chat/triage hostname rename, merged as 8ace4d47). Problem: the renamed hosts chat.bstein.dev and triage.bstein.dev serve TLS and route correctly, but login fails: Keycloak returns HTTP 400 "Invalid parameter: redirect_uri" because clients hermes-chat-proxy and hermes-triage-proxy still carry the pre-rename redirect URIs. The ensure Job (hermes-access-oidc-client-ensure-10) last ran before #34 changed hermes_access_oidc_ensure.sh. Fix: bump the Job name to ensure-11 so Flux recreates the immutable Job and reruns the script, which PUTs the new redirect_uri, webOrigins, rootUrl and post-logout values. Same convention as ensure-7..ensure-10. Verification after merge: Job completes in sso namespace; then GET https://chat.bstein.dev/ and https://triage.bstein.dev/ -> 302 to sso.bstein.dev -> Keycloak login form renders (no Invalid parameter error). Users must log in again because oauth2-proxy cookies are host-bound. No secrets are printed; the script only writes them to Vault.
hermes-automation added 1 commit 2026-08-21 08:40:11 +00:00 
PR #34 renamed the public chat/triage hosts in
hermes_access_oidc_ensure.sh (chat.bstein.dev, triage.bstein.dev) but
the last applied hermes-access-oidc-client-ensure Job predates that
change, so Keycloak still has the old redirect_uri/webOrigins/rootUrl
registered for hermes-chat-proxy and hermes-triage-proxy. Live check
confirms Keycloak returns HTTP 400 Invalid parameter: redirect_uri for
both new hosts. Bump the Job name to force Flux to recreate the
(immutable) Job and rerun the ensure script, matching this repo's
established retry convention for this Job (ensure-7..ensure-10).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
bstein closed this pull request 2026-08-22 20:22:18 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
atlas-reconciler bstein hermes-automation
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: titan/atlas-iac#36
No description provided.
Delete Branch "fix/hermes-oidc-ensure-rerun-hostname-rollout"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?