Kirill Ilin 1c8f0243cf feat(keycloak): isolate admin endpoints to a dedicated route ...

When ingress.adminHost is set, narrow the public (login) route to the
OIDC paths only (/realms, /resources, /.well-known) so the admin console
and Administration REST API are no longer served on the login hostname,
and serve them from a dedicated admin route instead. The admin route
attaches to the Gateway/ingressClass selected by _cluster.expose-ingress-admin
(defaults to expose-ingress), so it can be moved onto a separate, e.g.
private, Gateway. KC_HOSTNAME_ADMIN alone is not a security boundary;
the path and network separation here is what restricts access.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>

2026-06-25 15:29:46 +05:00

..

apps

fix(tenant): grant watch verb to cleanup Role so pre-delete hook can wait (#2923)

2026-06-25 12:29:04 +03:00

core

feat(platform): add publishing.ingressNameAdmin for a separate admin gateway

2026-06-25 15:28:47 +05:00

extra

feat(ingress): issue shared DNS-01 wildcard on the publishing controller

2026-06-22 20:01:40 +03:00

library

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00

system

feat(keycloak): isolate admin endpoints to a dedicated route

2026-06-25 15:29:46 +05:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00