첫 커밋: 로컬 프로젝트 업로드

2026-06-10 15:51:34 +09:00
commit 6a8dbeb2e9
1211 changed files with 312864 additions and 0 deletions
--- a/baron-sso/deploy/templates/.env.template
+++ b/baron-sso/deploy/templates/.env.template
@@ -0,0 +1,77 @@
+# === [1] 프로젝트 식별 (중요: 인스턴스마다 다르게 설정) ===
+INSTANCE_NAME={{INSTANCE_NAME}}
+COMPOSE_PROJECT_NAME=baron-sso-{{INSTANCE_NAME}}
+APP_ENV=production
+
+# === [2] 포트 Prefix 설정 (예: 23 입력 시 23000, 23432 등 생성) ===
+P={{PORT_PREFIX}}
+
+# 인프라 포트
+DB_PORT=${P}432
+REDIS_PORT=${P}399
+CLICKHOUSE_PORT_HTTP=${P}123
+CLICKHOUSE_PORT_NATIVE=${P}000
+
+# 서비스 포트
+BACKEND_PORT=${P}000
+USERFRONT_PORT=${P}500
+ADMINFRONT_PORT=${P}173
+DEVFRONT_PORT=${P}174
+ORGFRONT_PORT=${P}175
+OATHKEEPER_PROXY_PORT=${P}467
+
+# === [3] 도메인 설정 (별도 도메인 구조) ===
+# {{INSTANCE_NAME}}이 stg면 sso-stg.hmac.kr 형식이 되도록 가이드
+DOMAIN_SUFFIX=hmac.kr
+USERFRONT_URL=https://{{INSTANCE_NAME}}-sso.${DOMAIN_SUFFIX}
+ADMINFRONT_URL=https://{{INSTANCE_NAME}}-admin.${DOMAIN_SUFFIX}
+DEVFRONT_URL=https://{{INSTANCE_NAME}}-dev.${DOMAIN_SUFFIX}
+ORGFRONT_URL=https://{{INSTANCE_NAME}}-org.${DOMAIN_SUFFIX}
+
+# OIDC/Auth URL
+VITE_OIDC_AUTHORITY=${USERFRONT_URL}/oidc
+ADMINFRONT_CALLBACK_URLS=${ADMINFRONT_URL}/auth/callback
+DEVFRONT_CALLBACK_URLS=${DEVFRONT_URL}/auth/callback
+ORGFRONT_CALLBACK_URLS=${ORGFRONT_URL}/auth/callback
+
+# Ory URL
+KRATOS_UI_URL=${USERFRONT_URL}/auth
+KRATOS_BROWSER_URL=${USERFRONT_URL}/auth
+KRATOS_ADMIN_URL=http://kratos:4434
+HYDRA_PUBLIC_URL=${USERFRONT_URL}/oidc
+HYDRA_ADMIN_URL=http://hydra:4445
+OATHKEEPER_PUBLIC_URL=${USERFRONT_URL}
+KETO_READ_URL=http://keto:4466
+KETO_WRITE_URL=http://keto:4467
+
+# Ory versions
+KRATOS_VERSION=v26.2.0
+HYDRA_VERSION=v26.2.0
+KETO_VERSION=v26.2.0
+OATHKEEPER_VERSION=v26.2.0
+ORY_POSTGRES_TAG=17-alpine
+
+# === [4] IDP 및 DB Config ===
+IDP_PROVIDER=ory
+DB_PASSWORD=password
+ORY_POSTGRES_USER=ory
+ORY_POSTGRES_PASSWORD=generated_secret_here
+ORY_POSTGRES_DB=ory
+KRATOS_DB=ory_kratos
+HYDRA_DB=ory_hydra
+KETO_DB=ory_keto
+OATHKEEPER_UID=1001
+OATHKEEPER_GID=1001
+OATHKEEPER_INTROSPECT_CLIENT_ID=oathkeeper-introspect
+OATHKEEPER_INTROSPECT_CLIENT_SECRET=oathkeeper-secret
+CLICKHOUSE_PASSWORD=password
+REDIS_ADDR=redis:6379
+
+# Secrets (At least 32 chars)
+COOKIE_SECRET=at_least_32_characters_long_secret_12345
+JWT_SECRET=at_least_32_characters_long_secret_12345
+CSRF_COOKIE_SECRET=at_least_32_characters_long_secret_12345
+
+# Admin 초기 계정
+ADMIN_EMAIL=admin@baron.co.kr
+ADMIN_PASSWORD=adminPasswordIsNotSimple
--- a/baron-sso/deploy/templates/adminfront/vite.config.ts
+++ b/baron-sso/deploy/templates/adminfront/vite.config.ts
@@ -0,0 +1,32 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [react()],
+  envPrefix: ["VITE_", "USERFRONT_", "ORGFRONT_"],
+  cacheDir:
+    process.env.ADMINFRONT_VITE_CACHE_DIR ??
+    "/tmp/baron-sso-adminfront-vite-cache",
+  server: {
+    host: "127.0.0.1",
+    // 인스턴스별 도메인을 자동으로 허용
+    allowedHosts: ["{{ADMINFRONT_DOMAIN}}", "localhost", "127.0.0.1"],
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+  preview: {
+    host: "127.0.0.1",
+    port: 5173,
+    allowedHosts: ["{{ADMINFRONT_DOMAIN}}", "localhost", "127.0.0.1"],
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+});
--- a/baron-sso/deploy/templates/auth.template.ts
+++ b/baron-sso/deploy/templates/auth.template.ts
@@ -0,0 +1,21 @@
+import { UserManager, WebStorageStateStore } from "oidc-client-ts";
+import type { AuthProviderProps } from "react-oidc-context";
+
+export const oidcConfig: AuthProviderProps = {
+  authority:
+    import.meta.env.VITE_OIDC_AUTHORITY || `${window.location.protocol}//${window.location.hostname}:{{USERFRONT_PORT}}/oidc`,
+  client_id: import.meta.env.VITE_OIDC_CLIENT_ID || "{{CLIENT_ID}}",
+  redirect_uri: `${window.location.origin}/auth/callback`,
+  response_type: "code",
+  scope: "openid offline_access profile email",
+  post_logout_redirect_uri: window.location.origin,
+  userStore: new WebStorageStateStore({ store: window.localStorage }),
+  automaticSilentRenew: false,
+};
+
+export const userManager = new UserManager({
+  ...oidcConfig,
+  authority: oidcConfig.authority || "",
+  client_id: oidcConfig.client_id || "",
+  redirect_uri: oidcConfig.redirect_uri || "",
+});
--- a/baron-sso/deploy/templates/devfront/vite.config.ts
+++ b/baron-sso/deploy/templates/devfront/vite.config.ts
@@ -0,0 +1,29 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [react()],
+  envPrefix: ["VITE_", "USERFRONT_"],
+  server: {
+    host: "127.0.0.1",
+    // 인스턴스별 도메인을 자동으로 허용
+    allowedHosts: ["{{DEVFRONT_DOMAIN}}", "localhost", "127.0.0.1"],
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+  preview: {
+    host: "127.0.0.1",
+    port: 5173,
+    allowedHosts: ["{{DEVFRONT_DOMAIN}}", "localhost", "127.0.0.1"],
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+});
--- a/baron-sso/deploy/templates/docker-compose.yaml
+++ b/baron-sso/deploy/templates/docker-compose.yaml
@@ -0,0 +1,375 @@
+name: ${COMPOSE_PROJECT_NAME}
+
+services:
+  # --- Infrastructure ---
+  postgres:
+    image: postgres:17-alpine
+    container_name: ${COMPOSE_PROJECT_NAME}_db
+    environment:
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+    ports:
+      - "${DB_PORT}:5432"
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    networks: [app_net]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+
+  redis:
+    image: redis:7-alpine
+    container_name: ${COMPOSE_PROJECT_NAME}_redis
+    ports:
+      - "${REDIS_PORT}:6379"
+    networks: [app_net]
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:latest
+    container_name: ${COMPOSE_PROJECT_NAME}_clickhouse
+    environment:
+      - CLICKHOUSE_USER=baron
+      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
+    ports:
+      - "${CLICKHOUSE_PORT_HTTP}:8123"
+      - "${CLICKHOUSE_PORT_NATIVE}:9000"
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse
+    networks: [app_net]
+
+  # --- Ory Stack ---
+  postgres_ory:
+    image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
+    container_name: ${COMPOSE_PROJECT_NAME}_ory_db
+    environment:
+      - POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
+      - POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD}
+      - POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
+    volumes:
+      - ory_db_data:/var/lib/postgresql/data
+      - ./ory/init-db:/docker-entrypoint-initdb.d:ro
+    networks: [app_net]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}"]
+      interval: 5s
+
+  kratos-migrate:
+    image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+      - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+      - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
+      - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
+      - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
+      - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
+      - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
+      - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
+      - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
+      - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
+    volumes:
+      - ./config/.generated/ory/kratos:/etc/config/kratos:ro
+    command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
+    networks: [app_net]
+    depends_on:
+      postgres_ory: { condition: service_healthy }
+
+  kratos:
+    image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
+    container_name: ${COMPOSE_PROJECT_NAME}_kratos
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+      - COOKIE_SECRET=${COOKIE_SECRET}
+      - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+      - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
+      - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
+      - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
+      - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
+      - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
+      - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
+      - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
+      - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
+    volumes:
+      - ./config/.generated/ory/kratos:/etc/config/kratos:ro
+    command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
+    networks: [app_net]
+    depends_on:
+      kratos-migrate: { condition: service_completed_successfully }
+
+  hydra-migrate:
+    image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+    command: migrate sql up -e --yes
+    networks: [app_net]
+    depends_on:
+      postgres_ory: { condition: service_healthy }
+
+  hydra:
+    image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
+    container_name: ${COMPOSE_PROJECT_NAME}_hydra
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+      - URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}
+      - URLS_LOGIN=${HYDRA_LOGIN_URL:-${USERFRONT_URL}/login}
+      - URLS_CONSENT=${HYDRA_CONSENT_URL:-${USERFRONT_URL}/consent}
+      - URLS_ERROR=${HYDRA_ERROR_URL:-${USERFRONT_URL}/error}
+      - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
+    volumes:
+      - ./config/.generated/ory/hydra:/etc/config/hydra:ro
+    command: serve -c /etc/config/hydra/hydra.yml all --dev
+    networks: [app_net]
+    depends_on:
+      hydra-migrate: { condition: service_completed_successfully }
+
+  keto-migrate:
+    image: oryd/keto:${KETO_VERSION:-v26.2.0}
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+    volumes:
+      - ./config/.generated/ory/keto:/etc/config/keto:ro
+    command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
+    networks: [app_net]
+    depends_on:
+      postgres_ory: { condition: service_healthy }
+
+  keto:
+    image: oryd/keto:${KETO_VERSION:-v26.2.0}
+    container_name: ${COMPOSE_PROJECT_NAME}_keto
+    env_file: .env
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER:-ory}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+    volumes:
+      - ./config/.generated/ory/keto:/etc/config/keto:ro
+    command: serve -c /etc/config/keto/keto.yml
+    networks: [app_net]
+    depends_on:
+      keto-migrate: { condition: service_completed_successfully }
+
+  oathkeeper_logs_init:
+    image: alpine:latest
+    command: ["sh", "-c", "mkdir -p /var/log/oathkeeper && chown -R ${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001} /var/log/oathkeeper"]
+    volumes:
+      - oathkeeper_logs:/var/log/oathkeeper
+    networks: [app_net]
+
+  oathkeeper:
+    image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v26.2.0}
+    container_name: ${COMPOSE_PROJECT_NAME}_oathkeeper
+    env_file: .env
+    user: "${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001}"
+    ports:
+      - "${OATHKEEPER_PROXY_PORT}:4455"
+    environment:
+      - APP_ENV=${APP_ENV:-production}
+      - LOG_LEVEL=debug
+      - OATHKEEPER_INTROSPECT_CLIENT_ID=${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}
+      - OATHKEEPER_INTROSPECT_CLIENT_SECRET=${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}
+    volumes:
+      - ./config/.generated/ory/oathkeeper:/etc/config/oathkeeper:ro
+      - oathkeeper_logs:/var/log/oathkeeper
+    entrypoint: ["/etc/config/oathkeeper/entrypoint.sh"]
+    networks: [app_net]
+    depends_on:
+      oathkeeper_logs_init: { condition: service_completed_successfully }
+      kratos: { condition: service_started }
+      hydra: { condition: service_started }
+
+  ory_stack_check:
+    image: alpine:latest
+    container_name: ${COMPOSE_PROJECT_NAME}_ory_stack_check
+    command: >
+      /bin/sh -c "
+        apk add --no-cache curl;
+        echo 'Wait for Ory services...';
+        check_ready() {
+          name=\"$$1\";
+          url=\"$$2\";
+          max=\"$${ORY_STACK_CHECK_MAX_ATTEMPTS:-60}\";
+          i=1;
+          while [ \"$$i\" -le \"$$max\" ]; do
+            if curl --connect-timeout 2 --max-time 3 -fsS \"$$url\" >/dev/null; then
+              echo \"Ory service ready: $$name\";
+              return 0;
+            fi;
+            echo \"Waiting for Ory service: $$name ($$i/$$max)\";
+            i=$$((i + 1));
+            sleep 1;
+          done;
+          echo \"ERROR: Ory service not ready: $$name after $$max attempts ($$url)\" >&2;
+          echo \"ERROR: Check service logs: docker logs $${COMPOSE_PROJECT_NAME}_$$name\" >&2;
+          return 1;
+        };
+        check_ready kratos http://kratos:4433/health/ready || exit 1;
+        check_ready hydra http://hydra:4444/health/ready || exit 1;
+        check_ready keto http://keto:4466/health/ready || exit 1;
+        echo 'Ory stack is ready.';"
+    depends_on:
+      - kratos
+      - hydra
+      - keto
+    networks: [app_net]
+
+  init-rp:
+    image: oryd/hydra:${HYDRA_CLI_VERSION:-v26.2.0}
+    env_file: .env
+    entrypoint: ["/bin/sh", "-ec"]
+    command:
+      - |
+        upsert_client() {
+          ID=$$1
+          shift
+          if hydra get oauth2-client --endpoint "$${HYDRA_ADMIN_URL:-http://hydra:4445}" "$$ID" >/dev/null 2>&1; then
+            hydra update oauth2-client --endpoint "$${HYDRA_ADMIN_URL:-http://hydra:4445}" "$$ID" "$$@"
+          else
+            hydra create oauth2-client --endpoint "$${HYDRA_ADMIN_URL:-http://hydra:4445}" --id "$$ID" "$$@"
+          fi
+        }
+
+        upsert_client "adminfront" \
+          --name "AdminFront" \
+          --grant-type authorization_code,refresh_token \
+          --response-type code \
+          --scope openid,offline_access,profile,email \
+          --token-endpoint-auth-method none \
+          --redirect-uri "$${ADMINFRONT_CALLBACK_URLS:-$${ADMINFRONT_URL}/auth/callback}"
+
+        upsert_client "devfront" \
+          --name "DevFront" \
+          --grant-type authorization_code,refresh_token \
+          --response-type code \
+          --scope openid,offline_access,profile,email \
+          --token-endpoint-auth-method none \
+          --redirect-uri "$${DEVFRONT_CALLBACK_URLS:-$${DEVFRONT_URL}/auth/callback}"
+
+        upsert_client "orgfront" \
+          --name "OrgFront" \
+          --grant-type authorization_code,refresh_token \
+          --response-type code \
+          --scope openid,offline_access,profile,email \
+          --token-endpoint-auth-method none \
+          --redirect-uri "$${ORGFRONT_CALLBACK_URLS:-$${ORGFRONT_URL}/auth/callback}"
+
+        upsert_client "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" \
+          --secret "$${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}" \
+          --grant-type client_credentials \
+          --response-type token \
+          --scope openid,offline_access,profile,email
+    depends_on:
+      ory_stack_check: { condition: service_completed_successfully }
+    networks: [app_net]
+
+  # --- Application Services ---
+  backend:
+    image: baron-backend:latest
+    container_name: ${COMPOSE_PROJECT_NAME}_backend
+    env_file: .env
+    environment:
+      - PORT=${BACKEND_PORT}
+      - APP_ENV=${APP_ENV:-production}
+      - IDP_PROVIDER=${IDP_PROVIDER:-ory}
+      - USERFRONT_URL=${USERFRONT_URL}
+      - KRATOS_ADMIN_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - HYDRA_ADMIN_URL=${HYDRA_ADMIN_URL:-http://hydra:4445}
+      - HYDRA_PUBLIC_URL=${HYDRA_PUBLIC_URL}
+      - KETO_READ_URL=${KETO_READ_URL:-http://keto:4466}
+      - KETO_WRITE_URL=${KETO_WRITE_URL:-http://keto:4467}
+      - DB_HOST=postgres
+      - REDIS_ADDR=redis:6379
+      - CLICKHOUSE_HOST=clickhouse
+      - SEED_TENANT_CSV_PATH=/app/seed-tenant.csv
+    ports:
+      - "${BACKEND_PORT}:${BACKEND_PORT}"
+    volumes:
+      - ../../adminfront/seed-tenant.csv:/app/seed-tenant.csv:ro
+    networks: [app_net]
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_started }
+      oathkeeper: { condition: service_started }
+
+  gateway:
+    build:
+      context: ../..
+      dockerfile: ./userfront/Dockerfile
+      target: production
+    container_name: ${COMPOSE_PROJECT_NAME}_gateway
+    ports:
+      - "${USERFRONT_PORT}:80"
+    volumes:
+      - ./gateway/nginx.conf:/etc/nginx/nginx.conf:ro
+    networks: [app_net]
+
+  adminfront:
+    build:
+      context: ../..
+      dockerfile: ./adminfront/Dockerfile
+      args:
+        VITE_ADMIN_PUBLIC_URL: ${ADMINFRONT_URL}
+        VITE_OIDC_AUTHORITY: ${VITE_OIDC_AUTHORITY}
+        VITE_OIDC_CLIENT_ID: adminfront
+        ORGFRONT_URL: ${ORGFRONT_URL}
+    container_name: ${COMPOSE_PROJECT_NAME}_adminfront
+    env_file: .env
+    environment:
+      - APP_ENV=${APP_ENV:-production}
+      - API_PROXY_TARGET=http://backend:${BACKEND_PORT}
+    ports:
+      - "${ADMINFRONT_PORT}:5173"
+    networks: [app_net]
+
+  devfront:
+    build:
+      context: ../..
+      dockerfile: ./devfront/Dockerfile
+      args:
+        VITE_DEVFRONT_PUBLIC_URL: ${DEVFRONT_URL}
+        VITE_OIDC_AUTHORITY: ${VITE_OIDC_AUTHORITY}
+        VITE_OIDC_CLIENT_ID: devfront
+    container_name: ${COMPOSE_PROJECT_NAME}_devfront
+    env_file: .env
+    environment:
+      - APP_ENV=${APP_ENV:-production}
+      - API_PROXY_TARGET=http://backend:${BACKEND_PORT}
+    ports:
+      - "${DEVFRONT_PORT}:5173"
+    networks: [app_net]
+
+  orgfront:
+    build:
+      context: ../..
+      dockerfile: ./orgfront/Dockerfile
+      args:
+        VITE_ORGFRONT_PUBLIC_URL: ${ORGFRONT_URL}
+        VITE_OIDC_AUTHORITY: ${VITE_OIDC_AUTHORITY}
+        VITE_OIDC_CLIENT_ID: orgfront
+    container_name: ${COMPOSE_PROJECT_NAME}_orgfront
+    env_file: .env
+    environment:
+      - APP_ENV=${APP_ENV:-production}
+      - API_PROXY_TARGET=http://backend:${BACKEND_PORT}
+      - USERFRONT_URL=${USERFRONT_URL}
+    ports:
+      - "${ORGFRONT_PORT}:5175"
+    networks: [app_net]
+
+networks:
+  app_net:
+    name: ${COMPOSE_PROJECT_NAME}_net
+
+volumes:
+  db_data:
+    name: db_data_${INSTANCE_NAME}
+  ory_db_data:
+    name: ory_db_data_${INSTANCE_NAME}
+  clickhouse_data:
+    name: clickhouse_data_${INSTANCE_NAME}
+  oathkeeper_logs:
+    name: oathkeeper_logs_${INSTANCE_NAME}
--- a/baron-sso/deploy/templates/gateway/nginx.conf
+++ b/baron-sso/deploy/templates/gateway/nginx.conf
@@ -0,0 +1,42 @@
+worker_processes auto;
+events { worker_connections 1024; }
+
+http {
+    include /etc/nginx/mime.types;
+    
+    # 인스턴스별로 계산된 포트 주입
+    upstream backend_srv {
+        server backend:{{BACKEND_PORT}};
+    }
+
+    upstream oathkeeper_srv {
+        server oathkeeper:4455;
+    }
+
+    server {
+        listen 80;
+        
+        # SSO 메인 도메인 및 API 처리
+        location /api {
+            proxy_pass http://backend_srv;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location /auth {
+            proxy_pass http://oathkeeper_srv;
+            proxy_set_header Host $host;
+        }
+
+        location /oidc {
+            proxy_pass http://oathkeeper_srv;
+            proxy_set_header Host $host;
+        }
+
+        # 기본 정적 파일 (UserFront)
+        location / {
+            root /usr/share/nginx/html;
+            try_files $uri $uri/ /index.html;
+        }
+    }
+}
--- a/baron-sso/deploy/templates/orgfront/auth.ts
+++ b/baron-sso/deploy/templates/orgfront/auth.ts
@@ -0,0 +1,23 @@
+import { UserManager, WebStorageStateStore } from "oidc-client-ts";
+import type { AuthProviderProps } from "react-oidc-context";
+
+export const oidcConfig: AuthProviderProps = {
+  authority:
+    import.meta.env.VITE_OIDC_AUTHORITY ||
+    `${window.location.protocol}//${window.location.hostname}:{{USERFRONT_PORT}}/oidc`,
+  client_id: import.meta.env.VITE_OIDC_CLIENT_ID || "orgfront",
+  redirect_uri: `${window.location.origin}/auth/callback`,
+  response_type: "code",
+  scope: "openid offline_access profile email",
+  post_logout_redirect_uri: window.location.origin,
+  popup_redirect_uri: `${window.location.origin}/auth/callback`,
+  userStore: new WebStorageStateStore({ store: window.localStorage }),
+  automaticSilentRenew: false,
+};
+
+export const userManager = new UserManager({
+  ...oidcConfig,
+  authority: oidcConfig.authority || "",
+  client_id: oidcConfig.client_id || "",
+  redirect_uri: oidcConfig.redirect_uri || "",
+});
--- a/baron-sso/deploy/templates/orgfront/vite.config.ts
+++ b/baron-sso/deploy/templates/orgfront/vite.config.ts
@@ -0,0 +1,36 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+const allowedHosts = [
+  "{{ORGFRONT_DOMAIN}}",
+  "baron-orgchart.hmac.kr",
+  "localhost",
+  "127.0.0.1",
+].filter(Boolean);
+
+export default defineConfig({
+  plugins: [react()],
+  envPrefix: ["VITE_", "USERFRONT_"],
+  server: {
+    host: "127.0.0.1",
+    // 인스턴스별 도메인을 자동으로 허용합니다.
+    allowedHosts,
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+  preview: {
+    host: "127.0.0.1",
+    port: 5175,
+    allowedHosts,
+    proxy: {
+      "/api": {
+        target: process.env.API_PROXY_TARGET || "http://backend:{{BACKEND_PORT}}",
+        changeOrigin: true,
+      },
+    },
+  },
+});
--- a/baron-sso/deploy/templates/ory/kratos/kratos.yml.template
+++ b/baron-sso/deploy/templates/ory/kratos/kratos.yml.template
@@ -0,0 +1,102 @@
+version: v26.2.0
+
+dsn: ${KRATOS_DSN}
+
+serve:
+    public:
+        base_url: http://localhost:4433/
+        cors:
+            enabled: true
+            allowed_origins:
+                - http://backend:{{BACKEND_PORT}}
+                - http://localhost:{{USERFRONT_PORT}}
+    admin:
+        base_url: http://localhost:4434/
+
+session:
+    cookie:
+        domain: ${KRATOS_SESSION_COOKIE_DOMAIN}
+        same_site: Lax
+        path: /
+
+selfservice:
+    default_browser_return_url: http://localhost:{{USERFRONT_PORT}}/
+    allowed_return_urls:
+        - http://localhost:{{USERFRONT_PORT}}
+        - http://localhost:{{USERFRONT_PORT}}/
+        - http://localhost:{{USERFRONT_PORT}}/ko
+        - http://localhost:{{USERFRONT_PORT}}/ko/
+        - http://localhost:{{USERFRONT_PORT}}/en
+        - http://localhost:{{USERFRONT_PORT}}/en/
+        - http://localhost:{{USERFRONT_PORT}}/auth/callback
+        - http://localhost:{{USERFRONT_PORT}}/ko/auth/callback
+        - http://localhost:{{USERFRONT_PORT}}/en/auth/callback
+
+    methods:
+        password:
+            enabled: true
+        link:
+            enabled: true
+        code:
+            enabled: true
+            passwordless_enabled: true
+
+    flows:
+        error:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/error
+        settings:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/error?error=settings_disabled
+            privileged_session_max_age: 15m
+        recovery:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/recovery
+            use: code
+        verification:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/verification
+            use: code
+        logout:
+            after:
+                default_browser_return_url: http://localhost:{{USERFRONT_PORT}}/login
+        login:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/login
+            lifespan: 10m
+        registration:
+            ui_url: http://localhost:{{USERFRONT_PORT}}/registration
+            lifespan: 10m
+
+log:
+    level: debug
+    format: text
+    leak_sensitive_values: true
+
+secrets:
+    cookie:
+        - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
+    cipher:
+        - 32-LONG-SECRET-NOT-SECURE-AT-ALL
+
+ciphers:
+    algorithm: xchacha20-poly1305
+
+hashers:
+    algorithm: bcrypt
+    bcrypt:
+        cost: 8
+
+identity:
+    default_schema_id: default
+    schemas:
+        - id: default
+          url: file:///etc/config/kratos/identity.schema.json
+
+courier:
+    template_override_path: /etc/config/kratos/courier-templates
+    delivery_strategy: http
+    http:
+        request_config:
+            url: http://backend:{{BACKEND_PORT}}/api/v1/auth/webhooks/kratos-courier
+            method: POST
+            body: file:///etc/config/kratos/courier-http.jsonnet
+            headers:
+                Content-Type: application/json
+    smtp:
+        connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true
--- a/baron-sso/deploy/templates/ory/oathkeeper/rules.json
+++ b/baron-sso/deploy/templates/ory/oathkeeper/rules.json
@@ -0,0 +1,159 @@
+[
+  {
+    "id": "public-health",
+    "description": "공개 헬스체크",
+    "match": {
+      "url": "<.*>://<[^/]+>/health",
+      "methods": ["GET"]
+    },
+    "upstream": {
+      "url": "http://backend:{{BACKEND_PORT}}"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "public-preflight",
+    "description": "CORS preflight",
+    "match": {
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
+      "methods": ["OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://backend:{{BACKEND_PORT}}"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "public-auth",
+    "description": "인증/회원가입 등 공개 엔드포인트",
+    "match": {
+      "url": "<.*>://<[^/]+>/api/v1/auth/<.*>",
+      "methods": ["GET", "POST", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://backend:{{BACKEND_PORT}}"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "backend-command",
+    "description": "Command 요청은 Backend로 전달 (Audit 강제)",
+    "match": {
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
+      "methods": ["POST", "PUT", "PATCH", "DELETE"]
+    },
+    "upstream": {
+      "url": "http://backend:{{BACKEND_PORT}}"
+    },
+    "authenticators": [{ "handler": "cookie_session" }],
+    "authorizer": { "handler": "remote_json" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "backend-query",
+    "description": "Backend Query (admin/dev 포함)",
+    "match": {
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
+      "methods": ["GET"]
+    },
+    "upstream": {
+      "url": "http://backend:{{BACKEND_PORT}}"
+    },
+    "authenticators": [{ "handler": "cookie_session" }],
+    "authorizer": { "handler": "remote_json" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-well-known",
+    "description": "Hydra OIDC Discovery & JWKS",
+    "match": {
+      "url": "<.*>://<[^/]+>/.well-known/<.*>",
+      "methods": ["GET", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-well-known-oidc",
+    "description": "Hydra OIDC Discovery & JWKS (with /oidc prefix)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/.well-known/<.*>",
+      "methods": ["GET", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-oauth2",
+    "description": "Hydra OAuth2 Endpoints",
+    "match": {
+      "url": "<.*>://<[^/]+>/oauth2/<.*>",
+      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-oauth2-oidc",
+    "description": "Hydra OAuth2 Endpoints (with /oidc prefix)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/oauth2/<.*>",
+      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-userinfo",
+    "description": "Hydra Userinfo",
+    "match": {
+      "url": "<.*>://<[^/]+>/userinfo",
+      "methods": ["GET", "POST", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-userinfo-oidc",
+    "description": "Hydra Userinfo (with /oidc prefix)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/userinfo",
+      "methods": ["GET", "POST", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  }
+]
--- a/baron-sso/deploy/templates/userfront/nginx.conf
+++ b/baron-sso/deploy/templates/userfront/nginx.conf
@@ -0,0 +1,71 @@
+# ISO8601 시간을 "YYYY-MM-DD HH:mm:ss" 형식으로 변환
+map $time_iso8601 $time_custom {
+    "~^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})" "$1-$2-$3 $4:$5:$6";
+}
+
+# Go slog 포맷과 맞춘 JSON 액세스 로그
+log_format json_combined escape=json
+    '{'
+    '"time":"$time_custom",'
+    '"level":"INFO",'
+    '"msg":"http_access",'
+    '"svc":"baron-userfront",'
+    '"status":$status,'
+    '"method":"$request_method",'
+    '"path":"$request_uri",'
+    '"latency":"${request_time}s",'
+    '"ip":"$remote_addr",'
+    '"forwarded_for":"$http_x_forwarded_for",'
+    '"user_agent":"$http_user_agent"'
+    '}';
+
+server {
+    listen 5000;
+    include /etc/nginx/mime.types;
+    types {
+        application/javascript mjs;
+        application/wasm wasm;
+    }
+    
+    error_log /dev/stderr warn;
+    access_log /var/log/nginx/access.log json_combined;
+
+    # --- Backend API Proxy ---
+    location /api {
+        proxy_pass http://backend:{{BACKEND_PORT}};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # --- UserFront Static Files ---
+    
+    location ~* \.(js|css|html|json|mjs|wasm)$ {
+        root /usr/share/nginx/html;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files $uri =404;
+    }
+
+    location ~* \.mjs$ {
+        root /usr/share/nginx/html;
+        default_type application/javascript;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files $uri =404;
+    }
+
+    # dart2wasm 바이너리 MIME 명시
+    location ~* \.wasm$ {
+        root /usr/share/nginx/html;
+        default_type application/wasm;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files $uri =404;
+    }
+
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files $uri $uri/ /index.html;
+    }
+}