# Keycloak cluster of the S2I2S project

Two VMs, `m1.medium` (RAM 4 - VCPUs 2), Ubuntu 24.04, 30 GB of root disk, no
data volume, in a server group with the **hard** anti affinity policy
(`anti-affinity`: the scheduler fails instead of putting the two instances on
the same hypervisor).

Each instance has **two interfaces**:

| Interface | Address | Use |
|---|---|---|
| main private network | `10.10.0.163`, `10.10.0.164` | traffic from the L7 HAPROXY load balancers and from Prometheus, administration |
| `postgresql-srv-net` | from the DHCP pool | the only way to the database |

Security groups:

* `keycloak_cluster_traffic` — TCP, UDP and IGMP between the two nodes
  (Infinispan/JGroups). The rules use the static addresses of the instances, so
  they do not depend on the instances being created first;
* `traffic_to_keycloak_from_the_main_load_balancers` — ingress on 9443 from each
  HAPROXY L7, and on 9000 (management and metrics) from the load balancers and
  from Prometheus;
* `vm_access_to_the_postgresql_service` — taken from the `postgresql` workspace,
  on the port in the dedicated network of the database.

A CNAME `accounts.s2i2s.cloud.isti.cnr.it` pointing to the main load balancer is
created; the service itself is published by the HAPROXY L7 configuration (see
`docs/main_load_balancer.md` in `infrastructure-playbooks`, variable
`haproxy_l7_services`).

The resources and the sizing are in
[`../../modules/keycloak`](../../modules/keycloak), as defaults of
`keycloak_data`: override them in the module call to change them. The addresses
of the instances come from the address plan in [`../variables`](../variables)
(`basic_services_ip.keycloak_1` and `_2`, exported as the `keycloak_ip` list).

## Order of the applies

```
main_net_dns_router  ->  project-setup  ->  postgresql  ->  keycloak
```

This workspace reads the state of all three: the network and the DNS zone, the
default security group and the addresses of the load balancers and of
Prometheus, and the dedicated network of the database with its client security
group.

```bash
tofu init
tofu plan -out=keycloak.plan
tofu apply keycloak.plan
```

After the apply, regenerate the ansible inventory in
`infrastructure-playbooks`, which reads this state:

```bash
ansible-playbook tofu-inventory.yml --diff
```