Skip to content

Commit c2b5426

Browse files
committed
docs: Phase 1 Lab 04 complete — 20/120 labs (16.7%), CHANGELOG v1.0.0
1 parent 206c459 commit c2b5426

2 files changed

Lines changed: 65 additions & 20 deletions

File tree

CHANGELOG.md

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,57 @@ This project adheres to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
88

99
## [Unreleased]
1010

11-
### Planned — Next Up (Phase 1 Lab 04 Sprint)
12-
- `docker-compose.sso.yml` + `test-lab-XX-04.sh` for all 5 Phase 1 modules (Keycloak OIDC/SAML authentication)
11+
### Planned — Next Up (Phase 1 Lab 05 Sprint)
12+
- `docker-compose.integration.yml` + `test-lab-XX-05.sh` for all 5 Phase 1 modules (multi-module ecosystem integration)
1313
- `it-stack-installer` operational scripts (`clone-all-repos.ps1`, `update-all-repos.ps1`, `install-tools.ps1`)
1414

1515
---
1616

17+
## [1.0.0] — 2026-02-28
18+
19+
### Added — Phase 1 Lab 04: SSO Integration
20+
21+
All 5 Phase 1 modules have real Lab 04 Docker Compose stacks and test suites.
22+
Lab progress: 15/120 → 20/120 (12.5% → 16.7%). This milestone proves the full SSO chain end-to-end.
23+
24+
| Module | Compose | What's New | Test Lines |
25+
|--------|---------|------------|------------|
26+
| FreeIPA (01) | `docker-compose.sso.yml` | FreeIPA + Keycloak + KC-DB — LDAP federation component, user sync, OIDC discovery | 130 lines |
27+
| Keycloak (02) | `docker-compose.sso.yml` | Keycloak + KC-DB + OIDC app + MailHog — full OIDC/SAML hub | 142 lines |
28+
| PostgreSQL (03) | `docker-compose.sso.yml` | KC + KC-DB + PostgreSQL + pgAdmin + oauth2-proxy — pgAdmin gated by OIDC | 123 lines |
29+
| Redis (04) | `docker-compose.sso.yml` | KC + KC-DB + Redis + redis-commander + oauth2-proxy — UI gated by OIDC | 107 lines |
30+
| Traefik (18) | `docker-compose.sso.yml` | KC + KC-DB + Traefik + oauth2-proxy + whoami×2 — ForwardAuth middleware | 103 lines |
31+
32+
#### SSO Architecture Pattern (same across PostgreSQL, Redis, Traefik)
33+
34+
```
35+
Browser → Traefik/oauth2-proxy → Keycloak OIDC → protected service
36+
37+
it-stack realm
38+
oauth2-proxy client (confidential)
39+
labuser (test user)
40+
```
41+
42+
#### Test coverage highlights
43+
44+
- **FreeIPA:** LDAP port 389 reachable, admin LDAP bind, users OU present, Keycloak `it-stack` realm creation, LDAP federation component (`rhds` vendor, `cn=users,cn=accounts`), full user sync triggered, FreeIPA users visible in Keycloak, OIDC discovery, JWKS endpoint
45+
- **Keycloak:** Realm with brute-force protection, OIDC confidential client (service accounts + ROPC), SAML client, test user, client credentials grant, ROPC grant, JWT structure (3 parts + `iss`/`exp`/`iat` claims), token refresh, introspection (`active:true`), OIDC discovery (5 fields), SAML descriptor XML, MailHog :8025 + API
46+
- **PostgreSQL:** Keycloak + realm + client + user via REST API, client credentials token, JWT validation, OIDC discovery, UserInfo, token introspection, JWKS, oauth2-proxy `:4180` redirects to Keycloak (302), PostgreSQL query via labdb
47+
- **Redis:** Same OIDC flow + Redis PING/SET/GET/INFO, oauth2-proxy SSO gate redirects (302), JWKS signing keys
48+
- **Traefik:** Same OIDC flow + Traefik dashboard, `/public` → 200 (no auth), `/protected` → 302/401 (ForwardAuth intercepts), `/oauth2/callback` accessible, router count ≥2
49+
50+
#### CI workflow updates (all 5 repos)
51+
52+
- `validate` step: `docker-compose.sso.yml` now strictly validated with `config -q` individually
53+
- New `lab-04-smoke` job added to all 5 CI workflows (needs: validate, continue-on-error: true):
54+
- PostgreSQL: waits for KC ready (200s) + PG ready (60s) — runs `KC_PASS=Lab04Password! bash test-lab-03-04.sh`
55+
- Redis: waits for KC ready (200s) + Redis PONG (60s) — runs `KC_PASS=Lab04Password! bash test-lab-04-04.sh`
56+
- Traefik: waits for KC ready (200s) + Traefik API (60s) — runs `KC_PASS=Lab04Password! bash test-lab-18-04.sh`
57+
- Keycloak: waits for KC ready (200s) — runs `KC_PASS=Lab04Password! bash test-lab-02-04.sh`
58+
- FreeIPA: pull images + `config -q` + `bash -n` + ShellCheck (privileged — full test on real VMs)
59+
60+
---
61+
1762
## [0.9.0] — 2026-02-28
1863

1964
### Added — Phase 1 Lab 03: Advanced Features

docs/IT-STACK-TODO.md

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -172,20 +172,20 @@
172172

173173
## Phase 4: Module Scaffolding — Deployment Phase 1 (Foundation)
174174

175-
> **Status: ✅ COMPLETE** — 5 repos scaffolded · 30 issues filed · CI passing · Labs 01–03 real content done (15/120 labs)
175+
> **Status: ✅ COMPLETE** — 5 repos scaffolded · 30 issues filed · CI passing · Labs 01–04 real content done (20/120 labs)
176176
177-
- [x] `it-stack-freeipa`full scaffold + Lab 01 + Lab 02 + **`docker-compose.advanced.yml` + `test-lab-01-03.sh`** + CI ✅
178-
- [x] `it-stack-keycloak`full scaffold + Lab 01 + Lab 02 + **`docker-compose.advanced.yml` + `test-lab-02-03.sh`** + CI ✅
179-
- [x] `it-stack-postgresql`full scaffold + Lab 01 + Lab 02 + **`docker-compose.advanced.yml` + `test-lab-03-03.sh`** + CI ✅
180-
- [x] `it-stack-redis`full scaffold + Lab 01 + Lab 02 + **`docker-compose.advanced.yml` + `test-lab-04-03.sh`** + CI ✅
181-
- [x] `it-stack-traefik`full scaffold + Lab 01 + Lab 02 + **`docker-compose.advanced.yml` + `test-lab-18-03.sh`** + CI ✅
177+
- [x] `it-stack-freeipa`Labs 01–03 + **`docker-compose.sso.yml` + `test-lab-01-04.sh`** (LDAP federation) + CI ✅
178+
- [x] `it-stack-keycloak`Labs 01–03 + **`docker-compose.sso.yml` + `test-lab-02-04.sh`** (OIDC/SAML hub) + CI ✅
179+
- [x] `it-stack-postgresql`Labs 01–03 + **`docker-compose.sso.yml` + `test-lab-03-04.sh`** (pgAdmin+oauth2-proxy) + CI ✅
180+
- [x] `it-stack-redis`Labs 01–03 + **`docker-compose.sso.yml` + `test-lab-04-04.sh`** (redis-commander+oauth2-proxy) + CI ✅
181+
- [x] `it-stack-traefik`Labs 01–03 + **`docker-compose.sso.yml` + `test-lab-18-04.sh`** (ForwardAuth) + CI ✅
182182

183183
All 5 repos have:
184184
- [x] Full directory structure, manifest YAML, Makefile, Dockerfile
185-
- [x] 6 Docker Compose files (standalone + lan + advanced real · others scaffold)
186-
- [x] 6 lab test scripts (Labs 01–03 real · others scaffold)
185+
- [x] 6 Docker Compose files (standalone + lan + advanced + sso real · integration + production scaffold)
186+
- [x] 6 lab test scripts (Labs 01–04 real · Labs 05–06 scaffold)
187187
- [x] 3 GitHub Actions workflows: `ci.yml`, `release.yml`, `security.yml`
188-
- [x] `lab-01-smoke` + `lab-02-smoke` + `lab-03-smoke` CI jobs (all 5 green)
188+
- [x] `lab-01` through `lab-04-smoke` CI jobs (all 5 modules)
189189
- [x] CI/ShellCheck passing (all 5 green)
190190

191191
### 4.2 Lab Issues (30 total)
@@ -291,15 +291,15 @@ All 5 repos have:
291291

292292
| Module | Lab 01 | Lab 02 | Lab 03 | Lab 04 | Lab 05 | Lab 06 |
293293
|--------|--------|--------|--------|--------|--------|--------|
294-
| 01 · FreeIPA | [x] | [x] | [x] | [ ] | [ ] | [ ] |
295-
| 02 · Keycloak | [x] | [x] | [x] | [ ] | [ ] | [ ] |
294+
| 01 · FreeIPA | [x] | [x] | [x] | [x] | [ ] | [ ] |
295+
| 02 · Keycloak | [x] | [x] | [x] | [x] | [ ] | [ ] |
296296

297297
### Category 02: Database & Cache
298298

299299
| Module | Lab 01 | Lab 02 | Lab 03 | Lab 04 | Lab 05 | Lab 06 |
300300
|--------|--------|--------|--------|--------|--------|--------|
301-
| 03 · PostgreSQL | [x] | [x] | [x] | [ ] | [ ] | [ ] |
302-
| 04 · Redis | [x] | [x] | [x] | [ ] | [ ] | [ ] |
301+
| 03 · PostgreSQL | [x] | [x] | [x] | [x] | [ ] | [ ] |
302+
| 04 · Redis | [x] | [x] | [x] | [x] | [ ] | [ ] |
303303
| 05 · Elasticsearch | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
304304

305305
### Category 03: Collaboration
@@ -338,11 +338,11 @@ All 5 repos have:
338338

339339
| Module | Lab 01 | Lab 02 | Lab 03 | Lab 04 | Lab 05 | Lab 06 |
340340
|--------|--------|--------|--------|--------|--------|--------|
341-
| 18 · Traefik | [x] | [x] | [x] | [ ] | [ ] | [ ] |
341+
| 18 · Traefik | [x] | [x] | [x] | [x] | [ ] | [ ] |
342342
| 19 · Zabbix | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
343343
| 20 · Graylog | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
344344

345-
**Lab Progress:** 15/120 (12.5%) — Phase 1 Labs 01–03 complete for all 5 Phase 1 modules
345+
**Lab Progress:** 20/120 (16.7%) — Phase 1 Labs 01–04 complete for all 5 Phase 1 modules
346346

347347
---
348348

@@ -463,8 +463,8 @@ All 5 repos have:
463463
|--------|------|------|
464464
| ~~Sprint 2~~ | ~~Phase 1 Lab 02 (external deps)~~ | ~~freeipa·keycloak·postgresql·redis·traefik Lab 02~~|
465465
| ~~Sprint 3~~ | ~~Phase 1 Lab 03 (advanced features)~~ | ~~freeipa·keycloak·postgresql·redis·traefik Lab 03~~|
466-
| Next session | Phase 1 Lab 04 (SSO integration) | All 5 Lab 04 — proves full SSO chain |
467-
| Sprint 5 | Phase 1 Lab 05 (integrations) | All 5 Lab 05 |
466+
| ~~Sprint 4~~ | ~~Phase 1 Lab 04 (SSO integration)~~ | ~~freeipa·keycloak·postgresql·redis·traefik Lab 04~~ |
467+
| Next session | Phase 1 Lab 05 (advanced integration) | All 5 Lab 05 — multi-module ecosystem |
468468
| Sprint 5 | Phase 1 Lab 05 (integrations) | All 5 Lab 05 |
469469
| Sprint 6 | Phase 1 Lab 06 (production) | All 5 Lab 06 → Phase 1 complete |
470470
| Sprint 7+ | Phase 2 Lab 01 | nextcloud·mattermost·jitsi·iredmail·zammad |
@@ -473,4 +473,4 @@ All 5 repos have:
473473

474474
**Document Version:** 1.1
475475
**Project:** IT-Stack | **Org:** it-stack-dev
476-
**Last Updated:** 2026-02-28 — Phase 1 Lab 03 complete (15/120 labs, 12.5%)
476+
**Last Updated:** 2026-02-28 — Phase 1 Lab 04 complete (20/120 labs, 16.7%)

0 commit comments

Comments
 (0)