fix aiflow-keycloak problem

deploy/bootstrap.sh

@@ -237,7 +237,9 @@ bootstrap_keycloak() {
     ["trino"]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
     ["grafana"]="http GRAFANA_HOST GRAFANA_PORT 12300"
     ["openmetadata"]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
-    ["airflow"]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
+    # AIRFLOW_WEBSERVER_HOST (BUKAN AIRFLOW_HOST — itu penanda external, tak diisi
+    # generator → _comp_addr jatuh ke SICABE_HOST_ADDRESS/localhost).
+    ["airflow"]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
     ["starrocks"]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
   )
   _comp_addr() { # <host_var> → alamat efektif (IP/alamat, atau host ini bila co-located)

deploy/scripts/test-generate.sh

@@ -357,6 +357,22 @@ else
   bad "eksternal URL penuh belum didukung (wire=${_uo} parse=${_uo_parse} gen=${_uo_gen})"
 fi
 
+# ─── 0p. Origin client 'airflow' pakai AIRFLOW_WEBSERVER_HOST ─────────────────
+# Regresi: memakai `AIRFLOW_HOST` (penanda komponen external, SENGAJA tak diisi
+# generator) → _comp_addr/comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL),
+# sehingga di host non-pemilik (compute/state) origin jadi alamat host ITU, bukan
+# alamat control pemilik airflow → verify-keycloak FAIL "belum terdaftar di client".
+_ap=1
+grep -q '\[airflow\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" || _ap=0
+grep -q '\["airflow"\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/bootstrap.sh" || _ap=0
+grep -q '\[airflow\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" && _ap=0
+grep -q '\["airflow"\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/bootstrap.sh" && _ap=0
+if [[ "${_ap}" == "1" ]]; then
+  ok "client origin airflow: pakai AIRFLOW_WEBSERVER_HOST (verify-keycloak + bootstrap)"
+else
+  bad "client origin airflow masih pakai AIRFLOW_HOST (origin salah di host non-pemilik)"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \

deploy/scripts/verify-keycloak.sh

@@ -65,11 +65,15 @@ declare -A CLIENT_PUBLIC=(
 # redirectUris. Deteksi kesalahan umum: redirectUris hanya `https://localhost:12443/*`
 # padahal user membuka `https://<ip-host>:12443` → Keycloak menolak "invalid redirect_uri".
 #   <client> = "<scheme> <host_var> <port_var> <default_port>"
+# CATATAN: pakai var TOPOLOGI yang DIISI generator. `AIRFLOW_HOST` SENGAJA TIDAK
+# diisi (penanda komponen external, lihat generate.py) → memakainya membuat
+# comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL), sehingga origin salah
+# di host non-pemilik (mis. compute mengharap airflow di alamat compute, bukan control).
 declare -A CLIENT_ORIGIN=(
   [trino]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
   [grafana]="http GRAFANA_HOST GRAFANA_PORT 12300"
   [openmetadata]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
-  [airflow]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
+  [airflow]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
   [starrocks]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
 )
 # Alamat efektif: nilai var bila berupa ALAMAT (mengandung titik); kalau kosong/co-located