feat: locally keycloaak works?

Author: florianow

ingress.tf

@@ -50,10 +50,16 @@ resource "kubernetes_ingress_v1" "keycloak" {
     annotations = {
       "bunkerweb.io/USE_MODSECURITY"                = "yes"
       "bunkerweb.io/USE_ANTIBOT"                    = "no"
+      "bunkerweb.io/USE_LIMIT_REQ"                  = "no"
       "bunkerweb.io/USE_BAD_BEHAVIOR"               = "no"
       "bunkerweb.io/REDIRECT_HTTP_TO_HTTPS"         = "no"
       "bunkerweb.io/INTERCEPTED_ERROR_CODES"        = ""
       "bunkerweb.io/REVERSE_PROXY_INTERCEPT_ERRORS" = "no"
+      "bunkerweb.io/COOKIE_AUTO_SECURE_FLAG"        = "no"
+      "bunkerweb.io/COOKIE_FLAGS"                   = "* SameSite=Lax"
+      "bunkerweb.io/STRICT_TRANSPORT_SECURITY"      = ""
+      "bunkerweb.io/KEEP_UPSTREAM_HEADERS"          = "*"
+      "bunkerweb.io/CONTENT_SECURITY_POLICY"        = ""
     }
   }
 
@@ -84,3 +90,19 @@ resource "kubernetes_ingress_v1" "keycloak" {
 
   depends_on = [helm_release.bunkerweb]
 }
+
+resource "kubernetes_config_map" "keycloak_modsec" {
+  metadata {
+    name      = "keycloak-modsec-crs"
+    namespace = var.namespace
+
+    annotations = {
+      "bunkerweb.io/CONFIG_TYPE" = "modsec-crs"
+      "bunkerweb.io/CONFIG_SITE" = var.keycloak_domain
+    }
+  }
+
+  data = {
+    "keycloak-exclusions.conf" = "SecRuleRemoveById 934100-934199\nSecRuleRemoveById 953100\nSecRuleRemoveById 959100"
+  }
+}

keycloak.tf

@@ -138,7 +138,7 @@ resource "kubernetes_deployment" "keycloak" {
 
           env {
             name  = "KC_HOSTNAME"
-            value = "http://${var.keycloak_domain}:8080"
+            value = "http://${var.keycloak_domain}"
           }
 
           env {

seaweedfs.tf

@@ -17,7 +17,7 @@ resource "kubernetes_secret" "seaweedfs_iam" {
         type    = "oidc"
         enabled = true
         config = {
-          issuer      = "http://${var.keycloak_domain}:8080/realms/seaweedfs"
+          issuer      = "http://${var.keycloak_domain}/realms/seaweedfs"
           clientId    = "seaweedfs-client"
           jwksUri     = "http://keycloak.${var.namespace}.svc.cluster.local:8080/realms/seaweedfs/protocol/openid-connect/certs"
           userInfoUri = "http://keycloak.${var.namespace}.svc.cluster.local:8080/realms/seaweedfs/protocol/openid-connect/userinfo"
@@ -79,7 +79,7 @@ resource "kubernetes_secret" "seaweedfs_iam" {
               Action    = ["sts:AssumeRoleWithWebIdentity"]
               Condition = {
                 StringEquals = {
-                  "seaweed:Issuer" = "http://${var.keycloak_domain}:8080/realms/seaweedfs"
+                  "seaweed:Issuer" = "http://${var.keycloak_domain}/realms/seaweedfs"
                 }
               }
             }]
@@ -97,7 +97,7 @@ resource "kubernetes_secret" "seaweedfs_iam" {
               Action    = ["sts:AssumeRoleWithWebIdentity"]
               Condition = {
                 StringEquals = {
-                  "seaweed:Issuer" = "http://${var.keycloak_domain}:8080/realms/seaweedfs"
+                  "seaweed:Issuer" = "http://${var.keycloak_domain}/realms/seaweedfs"
                 }
               }
             }]
@@ -115,7 +115,7 @@ resource "kubernetes_secret" "seaweedfs_iam" {
               Action    = ["sts:AssumeRoleWithWebIdentity"]
               Condition = {
                 StringEquals = {
-                  "seaweed:Issuer" = "http://${var.keycloak_domain}:8080/realms/seaweedfs"
+                  "seaweed:Issuer" = "http://${var.keycloak_domain}/realms/seaweedfs"
                 }
               }
             }]

variables.tf

@@ -84,7 +84,7 @@ variable "mariadb_user" {
 
 variable "keycloak_admin_user" {
   type        = string
-  default     = "admin"
+  default     = "KeycloakAdmin123!"
   description = "Keycloak admin username"
 }