From bda913a0867d4195cfd6d2b78d1644a6c3f16f47 Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Thu, 11 Jun 2026 01:12:50 -0700
Subject: [PATCH] fix: resolve auth.<domain> via docker dns alias on caddy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

forward-auth and forgejo baked caddy's container ip for
auth.<domain> into /etc/hosts at boot; whenever caddy was recreated
its ip changed and every fresh oidc token exchange failed with
connection refused (existing sessions kept working, so it broke
silently — surfaced tonight as a 500 on the oauth2-proxy callback).
a network alias on the caddy service keeps docker dns current
instead, and both entrypoint hacks are gone.
---
 compose.yaml                          | 6 ++++++
 config/forgejo/init/entry.sh          | 2 --
 config/keycloak/forward-auth/entry.sh | 2 --
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/compose.yaml b/compose.yaml
index 90c38ea652d7b7e1284d3ca61a364d2e2ee603a2..4708f81903eeb04d71a791c11ece705568bb24e8 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -7,6 +7,12 @@ services:
       - 80:80
       - 443:443
     restart: unless-stopped
+    networks:
+      default:
+        aliases:
+          # lets containers reach keycloak through caddy at its public name
+          # without the stale-/etc/hosts-entry trick (the ip changes on recreate)
+          - "auth.${HOME_DOMAIN}"
     user: "$USER_ID:$GROUP_ID"
     volumes:
       - "./config:/etc/caddy:ro"
diff --git a/config/forgejo/init/entry.sh b/config/forgejo/init/entry.sh
index cde6fac7be682581928de11357e6d31a9d035931..bc443418425c035f8747ed33644429d0806444b3 100644
--- a/config/forgejo/init/entry.sh
+++ b/config/forgejo/init/entry.sh
@@ -5,8 +5,6 @@ mkdir -p /custom/conf
 envsubst </custom/init/app.ini >/custom/conf/app.ini
 chmod 444 /custom/conf/app.ini
 
-CADDY_IP="$(getent hosts caddy | awk '{print $1}')"
-echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
 
 /usr/bin/entrypoint echo meow >/dev/null
 su git -c "bash /custom/init/config.sh"
diff --git a/config/keycloak/forward-auth/entry.sh b/config/keycloak/forward-auth/entry.sh
index d8b5dca1fbc277f23f2f4c02cad16cece8ffe661..ba558ceea0fb9f86fec99779a245b22ba66a39de 100755
--- a/config/keycloak/forward-auth/entry.sh
+++ b/config/keycloak/forward-auth/entry.sh
@@ -1,8 +1,6 @@
 #!/bin/sh
 set -e
 
-CADDY_IP="$(nslookup caddy | awk '/^Address: / { print $2 }')"
-echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
 rm -f /etc/ssl/certs/caddy.crt
 ln -s /caddy/pki/authorities/root.crt /etc/ssl/certs/caddy.crt
 
-- 
2.54.0