fix(dev): resolve dev-web SSO Traefik IP dynamically (no hardcoded pin) #468

Merged

longjacksonle merged 2 commits from chore/dev-web-traefik-ip into main 2026-06-28 01:42:10 +02:00

Conversation 0 Commits 2 Files changed 3 +25 -7

longjacksonle commented 2026-06-28 01:39:02 +02:00

Owner

Copy link

What

Make the just dev-web Bunyip SSO routing robust to Traefik IP drift. Dev-only tooling - no app/runtime code changes.

Why

The chat container reaches the dev Bunyip OP server-to-server for OIDC discovery/JWKS at startup (LC-22 makes this mandatory, so a failure = boot refusal + restart loop). Because the public DNS path 404s for discovery, the compose pinned the issuer host to the dev Traefik on network-traefik-public via extra_hosts - but with a hardcoded IP (10.200.0.4). When that network is recreated Traefik gets a new IP, the pin goes stale, and the chat server can't fetch discovery and won't start. (Hit exactly this; the file's own comment admitted it needed manual refresh.)

How

• New dev/traefik-ip: scans network-traefik-public for the attached Traefik container and prints its current IPv4 (no hardcoded container name; prints nothing on failure).
• just dev-web injects TRAEFIK_PUBLIC_IP="$(./dev/traefik-ip)".
• compose.dev-web.yml extra_hosts now uses ${TRAEFIK_PUBLIC_IP:-10.200.0.3} - dynamic at every up, with a default so a bare docker compose up outside the recipe still works.

The pin still targets Traefik (TLS terminates there); only the IP discovery changed. The issuer string + ID-token iss validation are unaffected.

Verify

• ./dev/traefik-ip prints the live Traefik IP (10.200.0.3 here).
• docker compose config resolves extra_hosts to long-bunyip-api.a8n.run=10.200.0.3 both with the var set and via the fallback.
• The stack boots healthy (Up (healthy), listening addr=0.0.0.0:8080, no SSO error).

Only dev-web carries this pin (the saas dev compose does not), so it is the only recipe touched.

## What Make the `just dev-web` Bunyip SSO routing robust to Traefik IP drift. Dev-only tooling - no app/runtime code changes. ## Why The chat container reaches the dev Bunyip OP server-to-server for OIDC discovery/JWKS at startup (LC-22 makes this mandatory, so a failure = boot refusal + restart loop). Because the public DNS path 404s for discovery, the compose pinned the issuer host to the dev Traefik on `network-traefik-public` via `extra_hosts` - but with a **hardcoded IP** (`10.200.0.4`). When that network is recreated Traefik gets a new IP, the pin goes stale, and the chat server can't fetch discovery and won't start. (Hit exactly this; the file's own comment admitted it needed manual refresh.) ## How - New `dev/traefik-ip`: scans `network-traefik-public` for the attached Traefik container and prints its current IPv4 (no hardcoded container name; prints nothing on failure). - `just dev-web` injects `TRAEFIK_PUBLIC_IP="$(./dev/traefik-ip)"`. - `compose.dev-web.yml` `extra_hosts` now uses `${TRAEFIK_PUBLIC_IP:-10.200.0.3}` - dynamic at every `up`, with a default so a bare `docker compose up` outside the recipe still works. The pin still targets Traefik (TLS terminates there); only the IP discovery changed. The issuer string + ID-token `iss` validation are unaffected. ## Verify - `./dev/traefik-ip` prints the live Traefik IP (`10.200.0.3` here). - `docker compose config` resolves `extra_hosts` to `long-bunyip-api.a8n.run=10.200.0.3` both with the var set and via the fallback. - The stack boots healthy (`Up (healthy)`, `listening addr=0.0.0.0:8080`, no SSO error). Only `dev-web` carries this pin (the saas dev compose does not), so it is the only recipe touched.

longjacksonle added 2 commits 2026-06-28 01:39:02 +02:00

chore(dev): add dev/traefik-ip to resolve Traefik's current IP ... 0bd0c42673

Scans network-traefik-public for the attached Traefik container and prints its IPv4, so the dev-web stack can pin the Bunyip SSO issuer host to the right Traefik without a hardcoded IP. Prints nothing on failure so callers can fall back.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(dev): resolve dev-web SSO Traefik IP dynamically, not hardcoded ... d6c865c989

The chat container pins the Bunyip SSO issuer host to the dev Traefik on network-traefik-public so server-to-server discovery reaches it. That IP was hardcoded (10.200.0.4) and drifted when the network was recreated, leaving the server unable to fetch discovery and refusing to start (restart loop). Now `just dev-web` injects TRAEFIK_PUBLIC_IP from ./dev/traefik-ip and extra_hosts uses ${TRAEFIK_PUBLIC_IP:-...} with a default for a bare compose up. No app/runtime change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

longjacksonle scheduled this pull request to auto merge when all checks succeed 2026-06-28 01:39:38 +02:00

longjacksonle merged commit 361a4ddbcf into main 2026-06-28 01:42:10 +02:00

longjacksonle deleted branch chore/dev-web-traefik-ip 2026-06-28 01:42:10 +02:00

longjacksonle referenced this pull request from a commit 2026-06-28 01:42:12 +02:00

Merge pull request 'fix(dev): resolve dev-web SSO Traefik IP dynamically (no hardcoded pin)' (#468) from chore/dev-web-traefik-ip into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

psa-systems/lets-chat!468

No description provided.