Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

2026-08-19 18:24:00 +03:00
parent bbef7a30c9
commit c7a80e7256
103 changed files with 3457 additions and 3725 deletions
@@ -1,4 +1,5 @@
-KEYCLOAK_PUBLIC_URL=https://tohin.ru/auth
+PUBLIC_WEB_URL=https://chat.example.ru
+KEYCLOAK_PUBLIC_URL=https://chat.example.ru/auth
 KEYCLOAK_DB_URL=jdbc:postgresql://managed-pg.internal:6432/han_chat?sslmode=verify-full&currentSchema=keycloak&ApplicationName=keycloak
 KC_DB_URL_PROPERTIES=currentSchema=keycloak
 KC_BOOTSTRAP_ADMIN_USERNAME=bootstrap-admin
@@ -7,6 +7,9 @@ RUN --mount=type=cache,target=/root/.m2 mvn -B -ntp dependency:go-offline
 COPY src ./src
 COPY realm ./realm
 COPY themes ./themes
+COPY container-entrypoint.sh .
+RUN sed -i 's/\r$//' container-entrypoint.sh \
+    && /bin/sh -n container-entrypoint.sh
 RUN --mount=type=cache,target=/root/.m2 mvn -B -ntp clean verify

 FROM quay.io/keycloak/keycloak:26.1.4 AS keycloak-build
@@ -21,7 +24,7 @@ RUN /opt/keycloak/bin/kc.sh build
 FROM quay.io/keycloak/keycloak:26.1.4
 COPY --from=keycloak-build --chown=keycloak:keycloak /opt/keycloak/ /opt/keycloak/
 COPY --chown=keycloak:keycloak realm/han-chat-realm.json /opt/keycloak/data/import/han-chat-realm.json
-COPY --chown=keycloak:keycloak --chmod=0555 container-entrypoint.sh /opt/keycloak/bin/han-container-entrypoint
+COPY --from=provider-build --chown=keycloak:keycloak --chmod=0555 /build/container-entrypoint.sh /opt/keycloak/bin/han-container-entrypoint
 USER 1000
 EXPOSE 8080 9000
 ENTRYPOINT ["/opt/keycloak/bin/han-container-entrypoint"]
@@ -45,13 +45,14 @@ The browser token is validated by Keycloak before `OtpFlow.start()`. A provider

 SmartCaptcha CSP is applied only by nginx to the `han-chat` login and login-action endpoints. Never set a custom `browserSecurityHeaders.contentSecurityPolicy` in the realm: it can break Keycloak Admin Console and third-party cookie iframes.

-Before production deployment replace the explicit placeholder entries in `realm/han-chat-realm.json`:
+Realm import derives browser redirect, logout and web-origin URLs from the
+non-secret `PUBLIC_WEB_URL` environment variable. Keycloak resolves the
+`${PUBLIC_WEB_URL}` placeholders in `realm/han-chat-realm.json` during the
+initial `--import-realm`.

- `https://APP_LINK_HOST.example/auth/callback`
- `https://APP_LINK_HOST.example/auth/logout`
- `https://APP_WEB_ORIGIN.example`
-
-Use exact Expo universal/app links and web origins. Do not replace them with wildcards. `https://tohin.ru/auth/callback` and `han-chat://auth/callback` are already allow-listed.
+Use exact Expo universal/app links and web origins. Do not replace them with
+wildcards. `${PUBLIC_WEB_URL}/auth/callback` and `han-chat://auth/callback` are
+allow-listed by the initial realm import.

 The JDBC URL must use the managed PostgreSQL private endpoint, TLS verification and `currentSchema=keycloak`. The database role must have privileges only on schema `keycloak`.

@@ -109,4 +110,7 @@ Reserve, SMS HTTP order, and activation/order-failure run as separate transactio

 Before upgrading Keycloak, read migration notes, rebuild the provider against the exact target SPI version, test on a database clone, and execute OTP login/refresh/logout contract tests. Do not skip major versions without a supported path.

-Backups must include the full Keycloak schema (realm signing keys and provider tables). After restore verify issuer `https://tohin.ru/auth/realms/han-chat`, JWKS, client redirects, browser flow binding, challenge persistence and refresh revocation before opening traffic.
+Backups must include the full Keycloak schema (realm signing keys and provider
+tables). After restore verify issuer
+`${KEYCLOAK_PUBLIC_URL}/realms/han-chat`, JWKS, client redirects, browser flow
+binding, challenge persistence and refresh revocation before opening traffic.
@@ -21,7 +21,8 @@ services:
      KC_DB_URL: ${KEYCLOAK_DB_URL:?KEYCLOAK_DB_URL is required}
      KC_DB_USERNAME: ${KEYCLOAK_DB_USERNAME:?KEYCLOAK_DB_USERNAME is required}
      KC_DB_URL_PROPERTIES: ${KC_DB_URL_PROPERTIES:-currentSchema=keycloak}
-      KC_HOSTNAME: ${KEYCLOAK_PUBLIC_URL:-https://tohin.ru/auth}
+      KC_HOSTNAME: ${KEYCLOAK_PUBLIC_URL:?KEYCLOAK_PUBLIC_URL is required}
+      PUBLIC_WEB_URL: ${PUBLIC_WEB_URL:?PUBLIC_WEB_URL is required for realm import}
      KC_HOSTNAME_STRICT: "true"
      KC_HTTP_ENABLED: "true"
      KC_HTTP_PORT: "8080"
@@ -60,15 +60,15 @@
      "frontchannelLogout": true,
      "fullScopeAllowed": false,
      "redirectUris": [
-        "https://chat.han0107.ru/auth/callback",
+        "${PUBLIC_WEB_URL}/auth/callback",
        "han-chat://auth/callback"
      ],
      "webOrigins": [
-        "https://chat.han0107.ru"
+        "${PUBLIC_WEB_URL}"
      ],
      "attributes": {
        "pkce.code.challenge.method": "S256",
-        "post.logout.redirect.uris": "https://chat.han0107.ru/##han-chat://auth/logout",
+        "post.logout.redirect.uris": "${PUBLIC_WEB_URL}/##han-chat://auth/logout",
        "oauth2.device.authorization.grant.enabled": "false",
        "oidc.ciba.grant.enabled": "false",
        "use.refresh.tokens": "true",
@@ -28,6 +28,9 @@ class RealmContractTest {
        assertTrue(realm.contains("\"refreshTokenMaxReuse\": 0"));
        assertTrue(realm.contains("\"optionalClientScopes\": [\"offline_access\"]"));
        assertTrue(realm.contains("\"han-chat://auth/callback\""));
+        assertTrue(realm.contains("\"${PUBLIC_WEB_URL}/auth/callback\""));
+        assertTrue(realm.contains("\"${PUBLIC_WEB_URL}\""));
+        assertFalse(realm.contains("chat.han0107.ru"));
    }

    @Test