Bonnes pratiques¶

# postgresql.conf
wal_level = replica
archive_mode = on
archive_command = 'test ! -f /backup/wal/%f && cp %p /backup/wal/%f'
max_wal_senders = 5

#!/bin/bash
# Backup complet quotidien
pg_basebackup -h localhost -U replication -D /backup/base/$(date +%Y%m%d) \
  --wal-method=stream --checkpoint=fast --compress=gzip

# Retention : 7 jours de backups complets
find /backup/base -maxdepth 1 -type d -mtime +7 -exec rm -rf {} \;

# 1. Arreter Keycloak
systemctl stop keycloak

# 2. Restaurer le backup de base
rm -rf /var/lib/postgresql/data/*
tar xzf /backup/base/20260416/base.tar.gz -C /var/lib/postgresql/data/

# 3. Configurer la recovery
cat > /var/lib/postgresql/data/recovery.signal << EOF
EOF

cat >> /var/lib/postgresql/data/postgresql.conf << EOF
restore_command = 'cp /backup/wal/%f %p'
recovery_target_time = '2026-04-16 14:00:00'
EOF

# 4. Demarrer PostgreSQL (replay des WAL)
systemctl start postgresql

# 5. Verifier puis redemarrer Keycloak
systemctl start keycloak

# Deployer la nouvelle version en parallele
helm upgrade keycloak-green bitnami/keycloak \
  --namespace keycloak-green \
  --values values-keycloak-v26.yaml \
  --set replicaCount=1  # 1 seul replica pour tester

# Tester
curl -s https://keycloak-green.internal/health/ready

# Basculer le trafic
kubectl patch ingress keycloak -n keycloak-system \
  --type merge \
  -p '{"spec":{"rules":[{"host":"auth.example.com","http":{"paths":[{"path":"/","pathType":"Prefix","backend":{"service":{"name":"keycloak-green","port":{"number":8080}}}}]}}]}}'

# Decoder un JWT pour diagnostiquer
echo "eyJhbGciOiJS..." | cut -d. -f2 | base64 -d | jq .

# Verifier les cles publiques
curl -s https://auth.example.com/realms/organization/protocol/openid-connect/certs | jq .

# 1. Verifier l'endpoint de discovery
curl -s https://auth.example.com/realms/organization/.well-known/openid-configuration | jq .

# 2. Verifier le client existe
kcadm.sh get clients -r organization -q clientId=svc-gitea

# 3. Verifier les redirect URIs
kcadm.sh get clients/$CLIENT_ID -r organization | jq '.redirectUris'

# 4. Activer le logging debug temporairement
# Dans la console admin : Realm Settings > Events > Config
# Enabled Event Types : ajouter CODE_TO_TOKEN_ERROR

# Verifier la connectivite LDAP
ldapsearch -H ldaps://ldap.example.com:636 \
  -D "cn=keycloak,ou=services,dc=example,dc=com" \
  -W -b "ou=users,dc=example,dc=com" \
  "(uid=fabien)"

# Lancer une synchronisation manuelle
kcadm.sh create user-storage/$COMPONENT_ID/sync \
  -r organization \
  -s action=triggerFullSync

# Verifier les logs de synchronisation
podman logs keycloak 2>&1 | grep -i "ldap\|sync\|federation"

# Copier le certificat CA dans le conteneur
podman cp ca-ldap.crt keycloak:/tmp/ca-ldap.crt

# Importer dans le truststore Java
podman exec keycloak keytool -import -alias ldap-ca \
  -file /tmp/ca-ldap.crt \
  -keystore /opt/keycloak/conf/truststores/ldap-ca.jks \
  -storepass changeit -noprompt

# Redemarrer Keycloak
podman restart keycloak