mirror/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-09-29 23:52:55 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

nixos/keycloak: update options for release 25.0.0

Browse Source 
Reference: https://www.keycloak.org/docs/25.0.0/upgrading/
This commit is contained in:
Nick Cao 2024-06-10 07:40:05 -04:00
parent 134a223f3f
commit d10d0fc423
No known key found for this signature in database
4 changed files with 25 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/doc/manual/release-notes/rl-2205.section.md
View File

@ -453,7 +453,7 @@ In addition to numerous new and upgraded packages, this release has the followin
The new names are as follows:
- `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host)
- `forceBackendUrlToFrontendUrl`: [`services.keycloak.settings.hostname-strict-backchannel`](#opt-services.keycloak.settings.hostname-strict-backchannel)
- `forceBackendUrlToFrontendUrl`: `services.keycloak.settings.hostname-strict-backchannel`
- `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port)
- `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port)

3
nixos/doc/manual/release-notes/rl-2411.section.md
View File

@ -87,6 +87,9 @@
services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
```
- `keycloak` was updated to version 25, which introduces new hostname related options.
See [Upgrading Guide](https://www.keycloak.org/docs/25.0.1/upgrading/#migrating-to-25-0-0) for instructions.
- The `tracy` package no longer works on X11, since it's moved to Wayland
support, which is the intended default behavior by Tracy maintainers.
X11 users have to switch to the new package `tracy-x11`.

12
nixos/modules/services/web-apps/keycloak.md
View File

@ -68,13 +68,11 @@ to `/auth`. See the option description
for more details.
:::
[](#opt-services.keycloak.settings.hostname-strict-backchannel)
determines whether Keycloak should force all requests to go
through the frontend URL. By default,
Keycloak allows backend requests to
instead use its local hostname or IP address and may also
advertise it to clients through its OpenID Connect Discovery
endpoint.
[](#opt-services.keycloak.settings.hostname-backchannel-dynamic)
Keycloak has the capability to offer a separate URL for backchannel requests,
enabling internal communication while maintaining the use of a public URL
for frontchannel requests. Moreover, the backchannel is dynamically
resolved based on incoming headers endpoint.
For more information on hostname configuration, see the [Hostname
section of the Keycloak Server Installation and Configuration

28
nixos/modules/services/web-apps/keycloak.nix
View File

@ -328,8 +328,7 @@ in
};
hostname = mkOption {
type = nullOr str;
default = null;
type = str;
example = "keycloak.example.com";
description = ''
The hostname part of the public URL used as base for
@ -340,16 +339,13 @@ in
'';
};
hostname-strict-backchannel = mkOption {
hostname-backchannel-dynamic = mkOption {
type = bool;
default = false;
example = true;
description = ''
Whether Keycloak should force all requests to go
through the frontend URL. By default, Keycloak allows
backend requests to instead use its local hostname or
IP address and may also advertise it to clients
through its OpenID Connect Discovery endpoint.
Enables dynamic resolving of backchannel URLs,
including hostname, scheme, port and context path.
See <https://www.keycloak.org/server/hostname>
for more information about hostname configuration.
@ -482,12 +478,20 @@ in
message = "Setting up a local PostgreSQL db for Keycloak requires `standard_conforming_strings` turned on to work reliably";
}
{
assertion = cfg.settings.hostname != null || cfg.settings.hostname-url or null != null;
message = "Setting the Keycloak hostname is required, see `services.keycloak.settings.hostname`";
assertion = cfg.settings.hostname-url or null == null;
message = ''
The option `services.keycloak.settings.hostname-url' has been removed.
Set `services.keycloak.settings.hostname' instead.
See [New Hostname options](https://www.keycloak.org/docs/25.0.0/upgrading/#new-hostname-options) for details.
'';
}
{
assertion = !(cfg.settings.hostname != null && cfg.settings.hostname-url or null != null);
message = "`services.keycloak.settings.hostname` and `services.keycloak.settings.hostname-url` are mutually exclusive";
assertion = cfg.settings.hostname-strict-backchannel or null == null;
message = ''
The option `services.keycloak.settings.hostname-strict-backchannel' has been removed.
Set `services.keycloak.settings.hostname-backchannel-dynamic' instead.
See [New Hostname options](https://www.keycloak.org/docs/25.0.0/upgrading/#new-hostname-options) for details.
'';
}
];