sync dari sicabe-doc/deploy @ e8f8fde

deploy/scripts/test-generate.sh

@@ -89,9 +89,9 @@ grep -q '${MINIO_INTERNAL_PORT:-9000}'    "${dc}" || miss="${miss} MINIO"
 hard="$(grep -nE '\$\{(POSTGRES_HOST|KEYCLOAK_HOST|MINIO_HOST)[^}]*\}:(5432|8080|9000)' "${dc}" || true)"
 [[ -z "${hard}" ]] && ok "docker-compose: tak ada port internal literal di var *_HOST" \
                     || bad "docker-compose: masih ada port literal: ${hard}"
-grep -q '${ENV:KEYCLOAK_INTERNAL_PORT}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" \
-  && ok "Trino config: token/jwks-url pakai \${ENV:KEYCLOAK_INTERNAL_PORT}" \
-  || bad "Trino config: port Keycloak masih literal 8080"
+grep -q '${ENV:KEYCLOAK_INTERNAL_URL}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" \
+  && ok "Trino config: token/jwks-url pakai \${ENV:KEYCLOAK_INTERNAL_URL} (skema+host+port)" \
+  || bad "Trino config: URL Keycloak belum terparameter (token/jwks literal?)"
 grep -q ':{port}' "${DEPLOY_DIR}/lib/cluster/generate.py" \
   && ok "generate.py: URL_ENDPOINT_VARS memakai {port} (dari .env)" \
   || bad "generate.py: URL_ENDPOINT_VARS masih port literal"
@@ -225,20 +225,20 @@ else
   bad "verify-keycloak.sh hilang/tidak lengkap"
 fi
 
-# ─── 0k. Trino OAuth2: token/jwks pakai KEYCLOAK_HOST (bukan literal `keycloak`) ──
+# ─── 0k. Trino OAuth2: token/jwks pakai KEYCLOAK_INTERNAL_URL (bukan literal) ──
 # Kls bug sama dgn target MinIO Prometheus: Trino server-ke-server ke Keycloak. Bila
 # Keycloak EKSTERNAL (P3), literal `keycloak:` tak resolve → penukaran token gagal →
 # callback `/oauth2/callback` balas "Authentication response could not be verified".
 _tc="${DEPLOY_DIR}/config/trino/config-coordinator.properties"
-if grep -q 'token-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}' "${_tc}" 2>/dev/null \
-   && grep -q 'jwks-url=http://${ENV:KEYCLOAK_HOST}:' "${_tc}" 2>/dev/null \
+if grep -q 'token-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${_tc}" 2>/dev/null \
+   && grep -q 'jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${_tc}" 2>/dev/null \
    && grep -q 'oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}' "${_tc}" 2>/dev/null \
-   && grep -q 'KEYCLOAK_HOST: ${KEYCLOAK_HOST' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
+   && grep -q 'KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
    && grep -q 'TRINO_OAUTH_STATE_KEY: ${TRINO_OAUTH_STATE_KEY' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
    && ! grep -qE 'token-url=http://keycloak:' "${_tc}" 2>/dev/null; then
-  ok "trino oauth2: token-url/jwks-url pakai KEYCLOAK_HOST + state-key tetap"
+  ok "trino oauth2: token/jwks pakai KEYCLOAK_INTERNAL_URL + state-key tetap"
 else
-  bad "trino oauth2: token-url/jwks-url literal 'keycloak:' atau state-key belum diset"
+  bad "trino oauth2: token/jwks belum pakai KEYCLOAK_INTERNAL_URL atau state-key belum diset"
 fi
 
 # ─── 0l. StarRocks OIDC: redirect_url = alamat browser (bukan localhost) ──────
@@ -307,6 +307,56 @@ else
   bad "storage: konfigurasi bucket/warehouse belum lengkap →${wh_bad}"
 fi
 
+# ─── 0o. Komponen EKSTERNAL ber-URL penuh (domain + skema) ────────────────────
+# Client existing (mis. Keycloak) bisa sudah berdomain `https://sso.example.com`.
+# Alamat itu WAJIB didukung: skema+port dihormati (tak ditempeli http://…:12xxx) dan
+# server→server diarahkan lewat KEYCLOAK_INTERNAL_URL (token/jwks Trino & Grafana).
+_uo=1
+grep -q 'def parse_address' "${DEPLOY_DIR}/lib/cluster/inventory.py" || _uo=0
+grep -q 'def _ext_url' "${DEPLOY_DIR}/lib/cluster/generate.py" || _uo=0
+grep -q 'token-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" || _uo=0
+grep -q 'KEYCLOAK_INTERNAL_URL' "${DEPLOY_DIR}/docker-compose.yml" || _uo=0
+_uo_parse="$(python3 - "${DEPLOY_DIR}" <<'PY'
+import importlib.util, sys
+d = sys.argv[1]
+s = importlib.util.spec_from_file_location("inv", f"{d}/lib/cluster/inventory.py")
+inv = importlib.util.module_from_spec(s); s.loader.exec_module(inv)
+cases = {"https://sso.example.com": ("https", "sso.example.com", 443),
+         "http://minio.corp:9000": ("http", "minio.corp", 9000),
+         "https://sso.example.com:8443": ("https", "sso.example.com", 8443),
+         "sso.example.com": ("", "sso.example.com", None),
+         "10.20.0.10": ("", "10.20.0.10", None)}
+print("1" if all(inv.parse_address(k) == v for k, v in cases.items()) else "0")
+PY
+)"
+cat > "${OUT}/inv-url.yml" <<'YML'
+version: 1
+tls: { mode: none }
+hosts:
+  control: { address: 10.20.0.10, tiers: [identity, policy, pipeline, governance] }
+  compute: { address: 10.20.0.11, tiers: [coord, engine] }
+  state:   { address: 10.20.0.12, tiers: [state] }
+components:
+  keycloak: { address: https://sso.example.com }
+YML
+_uo_gen=0
+if python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
+      "${OUT}/inv-url.yml" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
+      "${OUT}/url" "${DEPLOY_DIR}/scripts/render-config.sh" > "${OUT}/uri.log" 2>&1; then
+  _ue="${OUT}/url/host-control/.env"
+  if grep -qx 'KEYCLOAK_HOST=sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_PUBLIC_URL=https://sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_INTERNAL_URL=https://sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_SSL_REQUIRED=external' "${_ue}" 2>/dev/null; then
+    _uo_gen=1
+  fi
+fi
+if [[ "${_uo}" == "1" && "${_uo_parse}" == "1" && "${_uo_gen}" == "1" ]]; then
+  ok "eksternal URL penuh: domain https dihormati + KEYCLOAK_INTERNAL_URL + sslRequired=external"
+else
+  bad "eksternal URL penuh belum didukung (wire=${_uo} parse=${_uo_parse} gen=${_uo_gen})"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \