fix(infra): local compose parity + host-browser OIDC (closes #91) #92

Merged

not merged 2 commits from fix/91-local-compose-parity into main 2026-07-16 12:45:09 +00:00

Conversation 0 Commits 2 Files Changed 3 +126 -1

not commented 2026-07-16 12:08:12 +00:00

Contributor

Copy Link

What & why

Closes #91. infra/docker-compose.local.yml (the no-make local stack) was missing the domain service and all three portals, and never wired host-browser OIDC — so browsing the behandel portal redirected to http://keycloak:8080/…, which a host browser can't resolve.

• Parity: add domain, self-service, openbaar, behandel (local now matches the CI-canonical docker-compose.yml service-for-service).
• BFF: give it the Keycloak + downstream env it was missing (it previously fell back to appsettings and couldn't reach Keycloak).
• Host-browser OIDC: pin Keycloak's frontend/issuer URL to http://localhost:8180 (KC_HOSTNAME) with KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true, so a host browser logs in on localhost:8180 while the BFF still validates in-network via keycloak:8080.
• Portals: bind-mount a localhost:8180 config.json over the image's baked keycloak:8080 one (infra/local-config/*). openbaar is anonymous, no config.

How verified

• docker compose -f infra/docker-compose.local.yml config valid; parity check shows nothing missing.
• Started Keycloak from the local compose and confirmed the discovery document:
  • host view (localhost:8180): issuer + all endpoints on localhost:8180 (what the browser uses).
  • in-network view (keycloak:8080): issuer stays http://localhost:8180/... (matches browser tokens) while jwks_uri/token_endpoint resolve to keycloak:8080 (reachable by the BFF).

Notes for reviewers

• The full portal→BFF→Keycloak login round-trip should get a quick browser smoke test on a real engine (I validated the Keycloak issuer/backchannel split and compose validity, but can't drive a browser here). Ports: self-service :8140, openbaar :8141, behandel :8142; users in docs/synthetic-data.md.
• On rootless podman the portal→BFF nginx proxy (resolver 127.0.0.11) may 502 (a separate known podman-vs-docker DNS quirk); login is a browser redirect and is unaffected. Works on Docker Desktop.
• No app-code change; docker-compose.yml (CI-canonical) is untouched.

## What & why Closes #91. `infra/docker-compose.local.yml` (the no-make local stack) was missing the `domain` service and all three portals, and never wired host-browser OIDC — so browsing the behandel portal redirected to `http://keycloak:8080/…`, which a host browser can't resolve. - **Parity**: add `domain`, `self-service`, `openbaar`, `behandel` (local now matches the CI-canonical `docker-compose.yml` service-for-service). - **BFF**: give it the Keycloak + downstream env it was missing (it previously fell back to appsettings and couldn't reach Keycloak). - **Host-browser OIDC**: pin Keycloak's frontend/issuer URL to `http://localhost:8180` (`KC_HOSTNAME`) with `KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true`, so a host browser logs in on `localhost:8180` while the BFF still validates in-network via `keycloak:8080`. - **Portals**: bind-mount a `localhost:8180` `config.json` over the image's baked `keycloak:8080` one (`infra/local-config/*`). openbaar is anonymous, no config. ## How verified - `docker compose -f infra/docker-compose.local.yml config` valid; parity check shows nothing missing. - Started Keycloak from the local compose and confirmed the discovery document: - **host view** (`localhost:8180`): `issuer` + all endpoints on `localhost:8180` (what the browser uses). - **in-network view** (`keycloak:8080`): `issuer` stays `http://localhost:8180/...` (matches browser tokens) while `jwks_uri`/`token_endpoint` resolve to `keycloak:8080` (reachable by the BFF). ## Notes for reviewers - The full portal→BFF→Keycloak login round-trip should get a quick browser smoke test on a real engine (I validated the Keycloak issuer/backchannel split and compose validity, but can't drive a browser here). Ports: self-service :8140, openbaar :8141, behandel :8142; users in `docs/synthetic-data.md`. - On rootless podman the portal→BFF nginx proxy (`resolver 127.0.0.11`) may 502 (a separate known podman-vs-docker DNS quirk); login is a browser redirect and is unaffected. Works on Docker Desktop. - No app-code change; `docker-compose.yml` (CI-canonical) is untouched.

not added 1 commit 2026-07-16 12:08:14 +00:00

fix(infra): local compose parity — add domain + portals, wire host-browser OIDC (closes #91) ... 9fc7b4487b

docker-compose.local.yml lacked the domain service and all three portals, and never wired

host-browser OIDC. Add them, give the BFF its Keycloak/downstream env, and pin Keycloak's issuer

to http://localhost:8180 with a dynamic backchannel so a host browser logs in on localhost:8180

while the BFF still validates in-network via keycloak:8080. Portals bind-mount a localhost:8180

config.json over the baked keycloak:8080 one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added the type:bugarea:infra labels 2026-07-16 12:08:15 +00:00

not added 1 commit 2026-07-16 12:20:58 +00:00

Merge branch 'main' into fix/91-local-compose-parity e94a2a38bb

not merged commit 951bdd8364 into main 2026-07-16 12:45:09 +00:00

not referenced this issue from a commit 2026-07-16 12:45:09 +00:00

fix(infra): local compose parity + host-browser OIDC (closes #91) (#92)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

area:acl

area:bff

area:docs

area:domain

area:event-subscriber

area:infra

area:portal-behandel

area:portal-beheer

area:portal-openbaar

area:portal-self-service

area:projection

area:workflow

type:adr-proposal

type:bug

type:chore

type:slice

No Label area:infra type:bug

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

eho

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#92