Keycloak traefik integration by prasadtalasila · Pull Request #45 · INTO-CPS-Association/workspace

prasadtalasila · 2026-01-24T08:43:39Z

This pull request resolves issue #38

Copilot

Pull request overview

Integrates Keycloak as an OIDC identity provider for the Traefik-secured workspace deployments and updates docs/config to support the new auth flow.

Changes:

Adds a Keycloak service to the secure compose files and configures traefik-forward-auth to use OIDC.
Updates environment/documentation to describe Keycloak setup, migration, and quick reference.
Tweaks the image publishing workflow test matrix/pull logic.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
`dtaas/.env.example`	Adds Keycloak-related env vars and reorganizes OAuth configuration comments.
`compose.traefik.secure.yml`	Adds embedded Keycloak service and switches forward-auth provider to OIDC.
`compose.traefik.secure.tls.yml`	Adds embedded Keycloak service and adjusts TLS routing + OIDC forward-auth settings.
`TRAEFIK_SECURE.md`	Updates secure deployment guide to include Keycloak-based auth instructions.
`KEYCLOAK_SETUP.md`	New detailed Keycloak setup guide.
`KEYCLOAK_QUICKREF.md`	New quick reference for Keycloak integration and configuration.
`KEYCLOAK_MIGRATION.md`	New migration guide from GitLab OAuth to Keycloak OIDC.
`CONFIGURATION.md`	Updates configuration docs to recommend Keycloak and provide updated `.env` guidance.
`CHANGELOG.md`	Records Keycloak integration and documentation additions.
`.github/workflows/workspace-publish.yml`	Adjusts Docker Hub test image selection/override logic.

Copilot · 2026-01-24T08:49:16Z

workspaces/test/dtaas/config/.env.example

@@ -25,10 +64,10 @@ OAUTH_SECRET=your_random_secret_key_here

 # Server Configuration
 # Replace with your domain name
-SERVER_DNS=localhost
+SERVER_DNS=https://foo.com


SERVER_DNS is used in Traefik Host() rules and Keycloak KC_HOSTNAME, so it must be a bare hostname (e.g., "foo.com"), not a URL with scheme. With the current example value "https://foo.com" the generated Host rule will be invalid and routing/auth cookies will likely break.

Copilot · 2026-01-24T08:49:16Z

workspaces/test/dtaas/compose.traefik.secure.yml

  traefik-forward-auth:
    image: thomseddon/traefik-forward-auth:2
    restart: unless-stopped


This PR is marked as resolving issue #38, but the secure compose still relies on traefik-forward-auth (it’s only reconfigured to OIDC). Issue #38’s acceptance criteria calls for removing forward-auth and integrating OIDC at the Traefik layer; either update the PR/issue status or implement the removal to avoid closing the issue prematurely.

Copilot · 2026-01-24T08:49:16Z

workspaces/test/dtaas/compose.traefik.secure.tls.yml

@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: traefik:v3.6.4
+    image: traefik:v2.11


compose.traefik.secure.tls.yml changes Traefik from v3.6.4 to v2.11, which is a major downgrade and inconsistent with the other compose variants. If there’s no hard requirement for v2, it’s safer to keep versions aligned and pin to a full patch version to avoid unexpected behavior changes.

Suggested change

image: traefik:v2.11

image: traefik:v3.6.4

Copilot · 2026-01-24T08:49:17Z

workspaces/test/dtaas/compose.traefik.secure.tls.yml

+      - KC_HOSTNAME_URL=http://${SERVER_DNS:-localhost}:8080/auth
+      - KC_HOSTNAME_ADMIN_URL=http://${SERVER_DNS:-localhost}:8080/auth


KC_HOSTNAME_URL and KC_HOSTNAME_ADMIN_URL are set to http://${SERVER_DNS}:8080/auth, but externally Keycloak is reached via Traefik on HTTPS (443) and there’s no host port 8080 mapping. This is likely to cause incorrect redirect/issuer URLs. Consider removing these or setting them to the externally reachable URL (typically https://${SERVER_DNS}/auth).

Suggested change

- KC_HOSTNAME_URL=http://${SERVER_DNS:-localhost}:8080/auth

- KC_HOSTNAME_ADMIN_URL=http://${SERVER_DNS:-localhost}:8080/auth

- KC_HOSTNAME_URL=https://${SERVER_DNS:-localhost}/auth

- KC_HOSTNAME_ADMIN_URL=https://${SERVER_DNS:-localhost}/auth

Copilot · 2026-01-24T08:49:17Z

workspaces/test/dtaas/TRAEFIK_SECURE.md

+After starting the services, you need to configure Keycloak. See [KEYCLOAK_SETUP.md](KEYCLOAK_SETUP.md) for detailed instructions.
+
+Quick steps:
+1. Access Keycloak at `http://foo.com/auth`


The guide hard-codes "foo.com" in the quick steps (e.g., Keycloak URL). Since earlier sections reference localhost and the compose uses SERVER_DNS, these examples can be confusing and lead to copy/paste misconfiguration. Consider using ${SERVER_DNS} in examples or consistently using localhost for the secure (non-TLS) guide.

Suggested change

1. Access Keycloak at `http://foo.com/auth`

1. Access Keycloak at `http://${SERVER_DNS}/auth`

Copilot · 2026-01-24T08:49:17Z

workspaces/test/dtaas/compose.traefik.secure.yml

+    volumes:
+      - keycloak-data:/opt/keycloak/data
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 || exit 1"]


Keycloak healthcheck uses /dev/tcp with CMD-SHELL, which depends on the container shell supporting that feature (typically bash). If /bin/sh doesn’t support /dev/tcp, the healthcheck will always fail and traefik-forward-auth won’t start due to depends_on: condition: service_healthy. Use an HTTP-based check or explicitly run a shell that supports the command.

Suggested change

test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 || exit 1"]

test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/auth/"]

Copilot · 2026-01-24T08:49:17Z

workspaces/test/dtaas/compose.traefik.secure.tls.yml

+    volumes:
+      - keycloak-data:/opt/keycloak/data
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 || exit 1"]


Keycloak healthcheck uses /dev/tcp with CMD-SHELL, which may not work under /bin/sh depending on the base image. If it fails, Keycloak will be marked unhealthy (even if serving traffic). Prefer an HTTP-based readiness check or a command that doesn’t rely on /dev/tcp shell support.

Suggested change

test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 || exit 1"]

test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/auth/health/ready"]

Copilot · 2026-01-24T08:49:18Z

workspaces/test/dtaas/compose.traefik.secure.tls.yml

+      - AUTH_HOST=${SERVER_DNS:-localhost}
+      - COOKIE_DOMAIN=${SERVER_DNS:-localhost}
+      - URL_PATH=/_oauth
+      - INSECURE_SKIP_VERIFY=true


INSECURE_SKIP_VERIFY=true disables TLS certificate verification for OIDC calls, which defeats a key benefit of the TLS compose. If this is only needed for self-signed dev certs, default it to false and document how to enable it explicitly for local testing.

Suggested change

- INSECURE_SKIP_VERIFY=true

# For local testing with self-signed certificates, run docker compose with INSECURE_SKIP_VERIFY=true

- INSECURE_SKIP_VERIFY=${INSECURE_SKIP_VERIFY:-false}

Copilot · 2026-01-24T08:49:18Z

OLD_CONF.md

+
+   # Secret key for encrypting OAuth session data
+   # Generate a random string (at least 16 characters)
+   OAUTH_SECRET=$(openssl rand -base64 32)


The sample .env snippet recommends setting OAUTH_SECRET to $(openssl rand -base64 32), but .env files do not evaluate shell expressions, so this will become a fixed, well-known secret value. Using a public, non-random OAUTH_SECRET allows attackers who know this configuration to forge or tamper with OAuth session cookies/tokens. Recommend generating a random value with openssl rand -base64 32 (or similar) and pasting the resulting string directly as the OAUTH_SECRET value rather than the command.

Suggested change

OAUTH_SECRET=$(openssl rand -base64 32)

# Example: run `openssl rand -base64 32` and paste the output here

OAUTH_SECRET=your_random_secret_key_here

Copilot · 2026-01-24T08:49:18Z

KEYCLOAK_SETUP.md

+# Generate a secure secret for OAuth sessions
+OAUTH_SECRET=$(openssl rand -base64 32)


The example .env configuration sets OAUTH_SECRET to $(openssl rand -base64 32), but .env files do not perform shell substitution, so this value will be used literally as a static, publicly-known secret. An attacker who knows this configuration can forge or tamper with OAuth session cookies/tokens, since the secret used for signing/encryption is predictable. Instead, generate a random secret with openssl rand -base64 32 (or similar) and paste the resulting value directly as the OAUTH_SECRET literal in the .env file.

Suggested change

# Generate a secure secret for OAuth sessions

OAUTH_SECRET=$(openssl rand -base64 32)

# Generate a secure secret for OAuth sessions with:

# openssl rand -base64 32

# Then paste the generated value below as a literal:

OAUTH_SECRET=PASTE_GENERATED_SECRET_HERE

codecov-commenter · 2026-02-16T12:13:06Z

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

- Split up the running of the install scripts in the Docker file into seperate layers make it simpler to differentiate the consequences of the installations. - added "--no-install-recommends" to jupyter and firefox install, to remove unneeded files and services (like locales) - Forced the firefox install to use IPv4 to access launchpad, reducing download time.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

prasadtalasila · 2026-02-16T14:40:48Z

@DisasterlyDisco The PR #53 is about build time optimization. Please move all the build time optimizations to it. It is better to keep this PR very specific to keycloak integration. Thanks.

prasadtalasila

@DisasterlyDisco Thanks for the updates. Please see the comments below.

prasadtalasila · 2026-02-16T14:41:57Z

workspaces/test/dtaas/compose.traefik.secure.tls.yml

 services:
  traefik:
-    image: traefik:v3.6.4
+    image: traefik:v2.11


please keep v3.6.4.

prasadtalasila · 2026-02-16T14:42:58Z

workspaces/test/dtaas/compose.traefik.secure.yml

+    image: quay.io/keycloak/keycloak:26.0.7
+    restart: unless-stopped
+    command:
+      - "start-dev"  # DEV ONLY - use 'start' with proper config in production


can this be set to production environment?

prasadtalasila · 2026-02-16T14:48:34Z

workspaces/test/dtaas/config/.env.example

 # Server Configuration
 # Replace with your domain name
-SERVER_DNS=localhost
+SERVER_DNS=https://foo.com


this should be bare hostname like copilot suggested

prasadtalasila · 2026-02-16T17:39:06Z

workspaces/test/dtaas/compose.traefik.secure.yml

      - frontend
      - users

+  keycloak:


The compose files must work with both keycloak and external (gitlab-like) oauth2 applications. Given the current size of the docker compose file, the following improvements will help.

profiles

include other docker files in this docker file

extend other docker files

prasadtalasila · 2026-02-16T17:39:52Z

workspaces/test/dtaas/TRAEFIK_SECURE.md

@@ -1,22 +1,22 @@
-# Workspace with Traefik Forward Auth (OAuth2 Security)
+# Workspace with Traefik Forward Auth (OIDC/Keycloak Security)


we need both generic OIDC and keycloak. Please see my comments on compose.traefik.secure.yml for potential ways of achieving this target.

prasadtalasila · 2026-02-16T17:40:25Z

workspaces/Dockerfile.ubuntu.noble.gnome

-    bash ${INST_DIR}/jupyter/install_jupyter.sh && \
-    bash ${INST_DIR}/admin/install_admin.sh && \
-    bash ${INST_DIR}/dtaas_cleanup.sh
+RUN bash ${INST_DIR}/firefox/install_firefox.sh


Is there an advantage to splitting them?

prasadtalasila · 2026-02-16T17:41:54Z

@DisasterlyDisco In addition to the comments given before, please fix the GitHub actions as well. Thanks.

- Upped traefik version - Made traefik and traefik-forward-auth dependent on healthy keycloak - Fixed an error in keycloak nevironment variables

prasadtalasila and others added 5 commits January 19, 2026 21:05

fix workflow file

ad0a5fd

[WIP] adds sample keyclock integration

0a3ba46

working traefik-keyclock integration

921c28e

Fixes documentation for keyclock setup

924055a

Updates to documentation

3b7cd02

Copilot AI review requested due to automatic review settings January 24, 2026 08:43

github-project-automation bot added this to workspace Jan 24, 2026

github-project-automation bot moved this to Backlog in workspace Jan 24, 2026

prasadtalasila removed this from workspace Jan 24, 2026

Copilot started reviewing on behalf of prasadtalasila January 24, 2026 08:43 View session

prasadtalasila added this to workspace Jan 24, 2026

github-project-automation bot moved this to Backlog in workspace Jan 24, 2026

Copilot AI reviewed Jan 24, 2026

View reviewed changes

prasadtalasila moved this from Backlog to In review in workspace Feb 11, 2026

prasadtalasila moved this from In review to In progress in workspace Feb 11, 2026

DisasterlyDisco added 2 commits February 16, 2026 12:11

Merge branch 'main' into keyclock-traefik-integration

5efa2e6

Added copy of old configuration

5c465db

Copilot AI review requested due to automatic review settings February 16, 2026 14:12

Copilot AI reviewed Feb 16, 2026

View reviewed changes

prasadtalasila changed the title ~~Keyclock traefik integration~~ Keycloak traefik integration Feb 16, 2026

prasadtalasila commented Feb 16, 2026

View reviewed changes

Small changes to compose.traefik.secure.tls.yml

b8ec4a5

- Upped traefik version - Made traefik and traefik-forward-auth dependent on healthy keycloak - Fixed an error in keycloak nevironment variables

		- KC_HOSTNAME_URL=http://${SERVER_DNS:-localhost}:8080/auth
		- KC_HOSTNAME_ADMIN_URL=http://${SERVER_DNS:-localhost}:8080/auth

	1. Access Keycloak at `http://foo.com/auth`
	1. Access Keycloak at `http://${SERVER_DNS}/auth`

	test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 \|\| exit 1"]
	test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/auth/"]

	test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 \|\| exit 1"]
	test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/auth/health/ready"]

	- INSECURE_SKIP_VERIFY=true
	# For local testing with self-signed certificates, run docker compose with INSECURE_SKIP_VERIFY=true
	- INSECURE_SKIP_VERIFY=${INSECURE_SKIP_VERIFY:-false}

	OAUTH_SECRET=$(openssl rand -base64 32)
	# Example: run `openssl rand -base64 32` and paste the output here
	OAUTH_SECRET=your_random_secret_key_here

		# Generate a secure secret for OAuth sessions
		OAUTH_SECRET=$(openssl rand -base64 32)

-# Generate a secure secret for OAuth sessions
-OAUTH_SECRET=$(openssl rand -base64 32)
+# Generate a secure secret for OAuth sessions with:
+#   openssl rand -base64 32
+# Then paste the generated value below as a literal:
+OAUTH_SECRET=PASTE_GENERATED_SECRET_HERE

		@@ -1,22 +1,22 @@
		# Workspace with Traefik Forward Auth (OAuth2 Security)
		# Workspace with Traefik Forward Auth (OIDC/Keycloak Security)

Conversation

prasadtalasila commented Jan 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Feb 16, 2026

Welcome to Codecov 🎉

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

prasadtalasila commented Feb 16, 2026

Uh oh!

prasadtalasila left a comment

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

prasadtalasila commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants