platform/sicabe-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync dari sicabe-doc/deploy @ e8f8fde

Browse Source
This commit is contained in:
subroto
2026-10-11 18:13:03 +07:00
parent 6e4dfb69ef
commit 9f454b6e8e
12 changed files with 191 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/config/trino/config-coordinator.properties
+7 -6
View File
@@ -41,17 +41,18 @@ http-server.process-forwarded=${ENV:TRINO_PROCESS_FORWARDED}
# single-host (localhost) dan multi-host tanpa TLS (http://<alamat-host-control>:12080).
# Kalau di-hardcode, issuer di klaster multi-host tidak cocok dan token ditolak.
http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe
# Matikan OIDC discovery — Trino tidak bisa mengakses URL publik dari dalam container.
# Endpoint di-set manual: browser pakai URL publik (auth-url); server-ke-server (token/jwks)
# pakai KEYCLOAK_HOST:INTERNAL_PORT — di multi-host dgn Keycloak EKSTERNAL ini = ALAMAT host
# pemilik (mis. 100.93.54.108:12080). JANGAN literal `keycloak` (nama container, tak resolve
# Server-ke-server (token/jwks) pakai KEYCLOAK_INTERNAL_URL — URL penuh
# (skema+host+port). Di multi-host dgn Keycloak EKSTERNAL berdomain mis.
# `https://sso.example.com`, nilainya persis itu (skema+port dihormati). Selain itu
# compose mengisi default `http://${KEYCLOAK_HOST}:${KEYCLOAK_INTERNAL_PORT}`
# (mis. 100.93.54.108:12080). JANGAN literal `keycloak` (nama container, tak resolve
# di host lain → penukaran token gagal → "Authentication response could not be verified").
http-server.authentication.oauth2.oidc.discovery=false
# Endpoint browser-facing (auth redirect) — harus URL publik juga
http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe/protocol/openid-connect/auth
# Endpoint server-side (token exchange & JWKS) — reachable dari container
http-server.authentication.oauth2.token-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/token
http-server.authentication.oauth2.jwks-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/certs
http-server.authentication.oauth2.token-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/token
http-server.authentication.oauth2.jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/certs
# Kunci HMAC tetap untuk `state` OAuth2 (default Trino = acak tiap coordinator start →
# sesi login batal saat restart). Nilai acak-per-instalasi dari .env.
http-server.authentication.oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}