From 91878bfbbd785e8738e79d6b2b6e661a9c8bde04 Mon Sep 17 00:00:00 2001 From: zlovtnik Date: Sat, 8 Aug 2026 20:23:52 -0400 Subject: [PATCH 1/2] fix: update BLOCKLIST_URL to use the correct domain list --- src/blocklist.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/blocklist.rs b/src/blocklist.rs index 877a542b..02cecea2 100644 --- a/src/blocklist.rs +++ b/src/blocklist.rs @@ -12,7 +12,7 @@ use crate::state::SharedState; /// Remote source of the periodically refreshed domain blocklist. pub const BLOCKLIST_URL: &str = - "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/ultimate-onlydomains.txt"; + "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/ultimate.txt"; const REFRESH_INTERVAL_SECS: u64 = 86_400; const INITIAL_FETCH_JITTER_MAX_SECS: u64 = 60; const MAX_LABEL_WALK_DEPTH: usize = 10; From 1a5534620b6439ccef405952882f7e50bbed8f92 Mon Sep 17 00:00:00 2001 From: zlovtnik Date: Sat, 8 Aug 2026 20:26:10 -0400 Subject: [PATCH 2/2] fix: reconcile Keycloak bootstrap admin --- .../base/schema-migrator/bootstrap-job.yaml | 28 +++++-- .../base/schema-migrator/keycloak.yaml | 73 +++++++++++++++++-- 2 files changed, 89 insertions(+), 12 deletions(-) diff --git a/cyber-stack/base/schema-migrator/bootstrap-job.yaml b/cyber-stack/base/schema-migrator/bootstrap-job.yaml index c06f421c..daad3854 100644 --- a/cyber-stack/base/schema-migrator/bootstrap-job.yaml +++ b/cyber-stack/base/schema-migrator/bootstrap-job.yaml @@ -41,8 +41,8 @@ spec: --config "$CONFIG" \ --server "$KEYCLOAK_URL" \ --realm master \ - --user "$KEYCLOAK_ADMIN" \ - --password - <<< "$KEYCLOAK_ADMIN_PASSWORD" >/dev/null 2>&1; then + --client "$KEYCLOAK_ADMIN_CLIENT_ID" \ + --secret "$KEYCLOAK_ADMIN_CLIENT_SECRET" >/dev/null 2>&1; then authenticated=true break fi @@ -53,6 +53,24 @@ spec: exit 1 fi + cleanup_bootstrap_admin() { + set +e + recovery_client_uuid="$($KCADM get clients --config "$CONFIG" -r master \ + -q "clientId=$KEYCLOAK_ADMIN_CLIENT_ID" --fields id --format csv --noquotes \ + | grep -v '^id$' | head -n 1)" + if [ -n "$recovery_client_uuid" ]; then + "$KCADM" delete "clients/$recovery_client_uuid" --config "$CONFIG" -r master + fi + } + trap cleanup_bootstrap_admin EXIT + + stale_admin_id="$($KCADM get users --config "$CONFIG" -r master \ + -q "username=keycloak-admin" -q exact=true --fields id --format csv --noquotes \ + | grep -v '^id$' | head -n 1)" + if [ -n "$stale_admin_id" ]; then + "$KCADM" delete "users/$stale_admin_id" --config "$CONFIG" -r master + fi + user_id="$($KCADM get users --config "$CONFIG" -r "$REALM" \ -q "username=$APP_USERNAME" -q exact=true --fields id --format csv --noquotes \ | grep -v '^id$' | head -n 1)" @@ -97,9 +115,9 @@ spec: env: - name: KEYCLOAK_URL value: "http://ssl-proxy-schema-migrator-keycloak:8080" - - name: KEYCLOAK_ADMIN - value: "keycloak-admin" - - name: KEYCLOAK_ADMIN_PASSWORD + - name: KEYCLOAK_ADMIN_CLIENT_ID + value: "ssl-proxy-bootstrap" + - name: KEYCLOAK_ADMIN_CLIENT_SECRET valueFrom: secretKeyRef: name: schema-migrator-keycloak diff --git a/cyber-stack/base/schema-migrator/keycloak.yaml b/cyber-stack/base/schema-migrator/keycloak.yaml index ec7656fb..9cf32340 100644 --- a/cyber-stack/base/schema-migrator/keycloak.yaml +++ b/cyber-stack/base/schema-migrator/keycloak.yaml @@ -97,6 +97,72 @@ spec: volumeMounts: - name: keycloak-home mountPath: /keycloak-home + - name: bootstrap-admin-service + image: quay.io/keycloak/keycloak:26.2.5 + imagePullPolicy: Always + command: ["/opt/keycloak/bin/kc.sh"] + args: + - bootstrap-admin + - service + - --client-id + - ssl-proxy-bootstrap + - --client-secret:env + - KC_BOOTSTRAP_RECOVERY_CLIENT_SECRET + - --no-prompt + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KC_DB + value: mysql + - name: KC_DB_URL_HOST + value: "ssl-proxy-tidb.$(POD_NAMESPACE).svc.cluster.local" + - name: KC_DB_URL_PORT + value: "4000" + - name: KC_DB_URL_DATABASE + value: "keycloak" + - name: KC_DB_URL_PROPERTIES + value: "?sslMode=VERIFY_IDENTITY&trustCertificateKeyStoreUrl=file:///run/tidb-tls/truststore.p12&trustCertificateKeyStoreType=PKCS12&trustCertificateKeyStorePassword=changeit&fallbackToSystemTrustStore=false" + - name: KC_DB_USERNAME + value: "keycloak" + - name: KC_DB_PASSWORD + valueFrom: + secretKeyRef: + name: tidb-keycloak + key: password + - name: KC_BOOTSTRAP_RECOVERY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: schema-migrator-keycloak + key: bootstrap-admin-password + resources: + requests: + cpu: 50m + memory: 128Mi + ephemeral-storage: 250Mi + limits: + cpu: 500m + memory: 1Gi + ephemeral-storage: 2Gi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + volumeMounts: + - name: keycloak-home + mountPath: /opt/keycloak + - name: keycloak-data + mountPath: /opt/keycloak/data + - name: tmp + mountPath: /tmp + - name: tidb-truststore + mountPath: /run/tidb-tls + readOnly: true containers: - name: keycloak image: quay.io/keycloak/keycloak:26.2.5 @@ -129,13 +195,6 @@ spec: secretKeyRef: name: tidb-keycloak key: password - - name: KC_BOOTSTRAP_ADMIN_USERNAME - value: "keycloak-admin" - - name: KC_BOOTSTRAP_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: schema-migrator-keycloak - key: bootstrap-admin-password - name: IDENTITY_HOSTNAME valueFrom: configMapKeyRef: