fix trino realm

deploy/config/trino/config-coordinator.properties

@@ -40,7 +40,7 @@ http-server.process-forwarded=${ENV:TRINO_PROCESS_FORWARDED}
 # Diambil dari KEYCLOAK_PUBLIC_URL (bukan ditulis tetap): nilainya berubah antara
 # single-host (localhost) dan multi-host tanpa TLS (http://<alamat-host-control>:12080).
 # Kalau di-hardcode, issuer di klaster multi-host tidak cocok dan token ditolak.
-http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe
+http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/${ENV:SICABE_REALM}
 # Server-ke-server (token/jwks) pakai KEYCLOAK_INTERNAL_URL — URL penuh
 # (skema+host+port). Di multi-host dgn Keycloak EKSTERNAL berdomain mis.
 # `https://sso.example.com`, nilainya persis itu (skema+port dihormati). Selain itu
@@ -49,10 +49,10 @@ http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicab
 # di host lain → penukaran token gagal → "Authentication response could not be verified").
 http-server.authentication.oauth2.oidc.discovery=false
 # Endpoint browser-facing (auth redirect) — harus URL publik juga
-http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe/protocol/openid-connect/auth
+http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/auth
 # Endpoint server-side (token exchange & JWKS) — reachable dari container
-http-server.authentication.oauth2.token-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/token
-http-server.authentication.oauth2.jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/certs
+http-server.authentication.oauth2.token-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/token
+http-server.authentication.oauth2.jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/certs
 # Kunci HMAC tetap untuk `state` OAuth2 (default Trino = acak tiap coordinator start →
 # sesi login batal saat restart). Nilai acak-per-instalasi dari .env.
 http-server.authentication.oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}

deploy/docker-compose.yml

@@ -472,6 +472,9 @@ services:
       # untuk issuer + auth-url. Trino GAGAL START bila variabel ini tidak ada (bukan
       # dianggap kosong), jadi sengaja diberi default eksplisit di sini.
       KEYCLOAK_PUBLIC_URL: ${KEYCLOAK_PUBLIC_URL:-http://localhost:${KEYCLOAK_PORT:-12080}}
+      # Realm Keycloak (issuer/auth-url/token/jwks di config-coordinator.properties lewat
+      # ${ENV:SICABE_REALM}). WAJIB ada: Trino gagal start bila variabel yang dirujuk tak ada.
+      SICABE_REALM: ${SICABE_REALM:-sicabe}
       # Di belakang Traefik (tls.mode edge/full) nilai ini `true`. Wajib ada: Trino gagal
       # start bila variabel yang dirujuk config.properties tidak tersedia.
       TRINO_PROCESS_FORWARDED: ${TRINO_PROCESS_FORWARDED:-false}

deploy/scripts/test-generate.sh

@@ -423,6 +423,20 @@ else
   bad "Nessie host-facing: port bisa salah untuk Nessie eksternal (beh='${_nr_beh}')"
 fi
 
+# ─── 0s. Realm Keycloak Trino terparameter (SICABE_REALM, bukan literal `sicabe`) ─
+# Regresi: issuer/auth/token/jwks Trino dipatok `/realms/sicabe` → client ber-realm lain
+# (SICABE_REALM != sicabe) tetap diarahkan ke realm `sicabe` → OIDC gagal.
+_sr_tc="${DEPLOY_DIR}/config/trino/config-coordinator.properties"
+_sr=1
+grep -q 'realms/sicabe' "${_sr_tc}" && _sr=0
+grep -q 'realms/${ENV:SICABE_REALM}' "${_sr_tc}" || _sr=0
+grep -q 'SICABE_REALM: ${SICABE_REALM:-sicabe}' "${DEPLOY_DIR}/docker-compose.yml" || _sr=0
+if [[ "${_sr}" == "1" ]]; then
+  ok "Trino OAuth2: realm pakai \${ENV:SICABE_REALM} + SICABE_REALM diteruskan ke container"
+else
+  bad "Trino OAuth2: realm masih literal 'sicabe' atau SICABE_REALM tak diteruskan"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \