ory스택 버전업 및 하드코딩URL 제거

2026-05-07 10:27:31 +09:00
parent 13dee9ae9b
commit 45a14163bf
25 changed files with 1583 additions and 779 deletions
--- a/docker/ory/kratos/kratos.yml
+++ b/docker/ory/kratos/kratos.yml
@@ -4,23 +4,18 @@ dsn: ${DSN}

 serve:
    public:
-        base_url: http://localhost:4433/
+        base_url: ${KRATOS_BROWSER_URL}
        cors:
            enabled: true
            allowed_origins:
-                - http://localhost:5173
-                - http://localhost:5174
-                - http://localhost:5175
-                - http://localhost:5000
+                - ${USERFRONT_URL}
+                - ${ADMINFRONT_URL}
+                - ${DEVFRONT_URL}
+                - ${ORGFRONT_URL}
                - http://backend:3000
                - http://baron_backend:3000
-                - https://ssologin.hmac.kr
-                - https://sso-test.hmac.kr
-                - https://app.brsw.kr
-                - https://sss.hmac.kr
-                - https://sso.hmac.kr
    admin:
-        base_url: http://localhost:4434/
+        base_url: ${KRATOS_ADMIN_URL}

 session:
    cookie:
@@ -29,21 +24,22 @@ session:
        path: /

 selfservice:
-    default_browser_return_url: http://localhost:5000/
+    default_browser_return_url: ${KRATOS_UI_URL}
    allowed_return_urls:
-        - http://baron_backend:3000
-        - http://baron_backend:3000/
-        - http://localhost:5000
-        - https://app.brsw.kr
-        - https://app.brsw.kr/
-        - https://sss.hmac.kr
-        - https://sss.hmac.kr/
-        - https://sso.hmac.kr
-        - https://sso.hmac.kr/
-        - https://ssologin.hmac.kr
-        - https://ssologin.hmac.kr/
-        - https://sso-test.hmac.kr
-        - https://sso-test.hmac.kr/
+        - ${KRATOS_UI_URL}
+        - ${KRATOS_UI_URL}/
+        - ${USERFRONT_URL}
+        - ${USERFRONT_URL}/
+        - ${USERFRONT_URL}/ko
+        - ${USERFRONT_URL}/ko/
+        - ${USERFRONT_URL}/en
+        - ${USERFRONT_URL}/en/
+        - ${USERFRONT_URL}/auth/callback
+        - ${USERFRONT_URL}/ko/auth/callback
+        - ${USERFRONT_URL}/en/auth/callback
+        - ${ADMINFRONT_URL}/auth/callback
+        - ${DEVFRONT_URL}/auth/callback
+        - ${ORGFRONT_URL}/auth/callback

    methods:
        password:
@@ -56,24 +52,24 @@ selfservice:

    flows:
        error:
-            ui_url: http://localhost:5000/error
+            ui_url: ${KRATOS_UI_URL}/error
        settings:
-            ui_url: http://localhost:5000/error?error=settings_disabled
+            ui_url: ${KRATOS_UI_URL}/error?error=settings_disabled
            privileged_session_max_age: 15m
        recovery:
-            ui_url: http://localhost:5000/recovery
+            ui_url: ${KRATOS_UI_URL}/recovery
            use: code
        verification:
-            ui_url: http://localhost:5000/verification
+            ui_url: ${KRATOS_UI_URL}/verification
            use: code
        logout:
            after:
-                default_browser_return_url: http://localhost:5000/login
+                default_browser_return_url: ${KRATOS_UI_URL}/login
        login:
-            ui_url: http://localhost:5000/login
+            ui_url: ${KRATOS_UI_URL}/login
            lifespan: 10m
        registration:
-            ui_url: http://localhost:5000/registration
+            ui_url: ${KRATOS_UI_URL}/registration
            lifespan: 10m

 log:
--- a/docker/ory/oathkeeper/rules.active.json
+++ b/docker/ory/oathkeeper/rules.active.json
@@ -3,7 +3,7 @@
    "id": "public-health",
    "description": "공개 헬스체크",
    "match": {
-      "url": "<.*>://<.*>/health",
+      "url": "<.*>://<[^/]+>/health",
      "methods": ["GET"]
    },
    "upstream": {
@@ -17,7 +17,7 @@
    "id": "public-preflight",
    "description": "CORS preflight",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["OPTIONS"]
    },
    "upstream": {
@@ -31,7 +31,7 @@
    "id": "public-auth",
    "description": "인증/회원가입 등 공개 엔드포인트",
    "match": {
-      "url": "<.*>://<.*>/api/v1/auth/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/auth/<.*>",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -45,7 +45,7 @@
    "id": "backend-command",
    "description": "Command 요청은 Backend로 전달 (Audit 강제)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["POST", "PUT", "PATCH", "DELETE"]
    },
    "upstream": {
@@ -59,7 +59,7 @@
    "id": "backend-query",
    "description": "Backend Query (admin/dev 포함)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["GET"]
    },
    "upstream": {
@@ -73,7 +73,7 @@
    "id": "hydra-well-known",
    "description": "Hydra OIDC Discovery & JWKS",
    "match": {
-      "url": "<.*>://<.*>/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
@@ -87,12 +87,12 @@
    "id": "hydra-well-known-oidc",
    "description": "Hydra OIDC Discovery & JWKS (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -102,7 +102,7 @@
    "id": "hydra-oauth2",
    "description": "Hydra OAuth2 Endpoints",
    "match": {
-      "url": "<.*>://<.*>/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
@@ -116,12 +116,12 @@
    "id": "hydra-oauth2-oidc",
    "description": "Hydra OAuth2 Endpoints (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -131,7 +131,7 @@
    "id": "hydra-userinfo",
    "description": "Hydra Userinfo",
    "match": {
-      "url": "<.*>://<.*>/userinfo",
+      "url": "<.*>://<[^/]+>/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -145,12 +145,12 @@
    "id": "hydra-userinfo-oidc",
    "description": "Hydra Userinfo (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/userinfo",
+      "url": "<.*>://<[^/]+>/oidc/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
--- a/docker/ory/oathkeeper/rules.json
+++ b/docker/ory/oathkeeper/rules.json
@@ -3,7 +3,7 @@
    "id": "public-health",
    "description": "공개 헬스체크",
    "match": {
-      "url": "<.*>://<.*>/health",
+      "url": "<.*>://<[^/]+>/health",
      "methods": ["GET"]
    },
    "upstream": {
@@ -17,7 +17,7 @@
    "id": "public-preflight",
    "description": "CORS preflight",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["OPTIONS"]
    },
    "upstream": {
@@ -31,7 +31,7 @@
    "id": "public-auth",
    "description": "인증/회원가입 등 공개 엔드포인트",
    "match": {
-      "url": "<.*>://<.*>/api/v1/auth/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/auth/<.*>",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -45,7 +45,7 @@
    "id": "backend-command",
    "description": "Command 요청은 Backend로 전달 (Audit 강제)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["POST", "PUT", "PATCH", "DELETE"]
    },
    "upstream": {
@@ -59,7 +59,7 @@
    "id": "backend-query",
    "description": "Backend Query (admin/dev 포함)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["GET"]
    },
    "upstream": {
@@ -73,7 +73,7 @@
    "id": "hydra-well-known",
    "description": "Hydra OIDC Discovery & JWKS",
    "match": {
-      "url": "<.*>://<.*>/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
@@ -87,12 +87,12 @@
    "id": "hydra-well-known-oidc",
    "description": "Hydra OIDC Discovery & JWKS (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -102,7 +102,7 @@
    "id": "hydra-oauth2",
    "description": "Hydra OAuth2 Endpoints",
    "match": {
-      "url": "<.*>://<.*>/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
@@ -116,12 +116,12 @@
    "id": "hydra-oauth2-oidc",
    "description": "Hydra OAuth2 Endpoints (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -131,7 +131,7 @@
    "id": "hydra-userinfo",
    "description": "Hydra Userinfo",
    "match": {
-      "url": "<.*>://<.*>/userinfo",
+      "url": "<.*>://<[^/]+>/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -145,12 +145,12 @@
    "id": "hydra-userinfo-oidc",
    "description": "Hydra Userinfo (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/userinfo",
+      "url": "<.*>://<[^/]+>/oidc/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
--- a/docker/ory/oathkeeper/rules.prod.json
+++ b/docker/ory/oathkeeper/rules.prod.json
@@ -1,9 +1,9 @@
 [
  {
    "id": "public-health",
-    "description": "공개 헬스체크 (PROD 도메인)",
+    "description": "공개 헬스체크 (PROD)",
    "match": {
-      "url": "https://app.brsw.kr/health",
+      "url": "<.*>://<[^/]+>/health",
      "methods": ["GET"]
    },
    "upstream": {
@@ -15,9 +15,9 @@
  },
  {
    "id": "public-preflight",
-    "description": "CORS preflight (PROD 도메인)",
+    "description": "CORS preflight (PROD)",
    "match": {
-      "url": "https://app.brsw.kr/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["OPTIONS"]
    },
    "upstream": {
@@ -29,9 +29,9 @@
  },
  {
    "id": "public-auth",
-    "description": "인증/회원가입 등 공개 엔드포인트 (PROD 도메인)",
+    "description": "인증/회원가입 등 공개 엔드포인트 (PROD)",
    "match": {
-      "url": "https://app.brsw.kr/api/v1/auth/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/auth/<.*>",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -45,7 +45,7 @@
    "id": "backend-command",
    "description": "Command 요청은 Backend로 전달 (Audit 강제)",
    "match": {
-      "url": "https://app.brsw.kr/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["POST", "PUT", "PATCH", "DELETE"]
    },
    "upstream": {
@@ -59,7 +59,7 @@
    "id": "backend-query",
    "description": "Backend Query (admin/dev 포함)",
    "match": {
-      "url": "https://app.brsw.kr/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["GET"]
    },
    "upstream": {
@@ -68,5 +68,92 @@
    "authenticators": [{ "handler": "cookie_session" }],
    "authorizer": { "handler": "remote_json" },
    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-well-known",
+    "description": "Hydra OIDC Discovery & JWKS (PROD)",
+    "match": {
+      "url": "<.*>://<[^/]+>/.well-known/<.*>",
+      "methods": ["GET", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-well-known-oidc",
+    "description": "Hydra OIDC Discovery & JWKS with /oidc prefix (PROD)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/.well-known/<.*>",
+      "methods": ["GET", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-oauth2",
+    "description": "Hydra OAuth2 Endpoints (PROD)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oauth2/<.*>",
+      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-oauth2-oidc",
+    "description": "Hydra OAuth2 Endpoints with /oidc prefix (PROD 도메인)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/oauth2/<.*>",
+      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-userinfo",
+    "description": "Hydra Userinfo (PROD)",
+    "match": {
+      "url": "<.*>://<[^/]+>/userinfo",
+      "methods": ["GET", "POST", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
+  },
+  {
+    "id": "hydra-userinfo-oidc",
+    "description": "Hydra Userinfo with /oidc prefix (PROD 도메인)",
+    "match": {
+      "url": "<.*>://<[^/]+>/oidc/userinfo",
+      "methods": ["GET", "POST", "OPTIONS"]
+    },
+    "upstream": {
+      "url": "http://hydra:4444",
+      "strip_path": "/oidc"
+    },
+    "authenticators": [{ "handler": "noop" }],
+    "authorizer": { "handler": "allow" },
+    "mutators": [{ "handler": "noop" }]
  }
 ]
--- a/docker/ory/oathkeeper/rules.stage.json
+++ b/docker/ory/oathkeeper/rules.stage.json
@@ -3,7 +3,7 @@
    "id": "public-health",
    "description": "공개 헬스체크",
    "match": {
-      "url": "<.*>://<.*>/health",
+      "url": "<.*>://<[^/]+>/health",
      "methods": ["GET"]
    },
    "upstream": {
@@ -17,7 +17,7 @@
    "id": "public-preflight",
    "description": "CORS preflight",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["OPTIONS"]
    },
    "upstream": {
@@ -31,7 +31,7 @@
    "id": "public-auth",
    "description": "인증/회원가입 등 공개 엔드포인트",
    "match": {
-      "url": "<.*>://<.*>/api/v1/auth/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/auth/<.*>",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -45,7 +45,7 @@
    "id": "backend-command",
    "description": "Command 요청은 Backend로 전달 (Audit 강제)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["POST", "PUT", "PATCH", "DELETE"]
    },
    "upstream": {
@@ -59,7 +59,7 @@
    "id": "backend-query",
    "description": "Backend Query (admin/dev 포함)",
    "match": {
-      "url": "<.*>://<.*>/api/v1/<.*>",
+      "url": "<.*>://<[^/]+>/api/v1/<.*>",
      "methods": ["GET"]
    },
    "upstream": {
@@ -73,7 +73,7 @@
    "id": "hydra-well-known",
    "description": "Hydra OIDC Discovery & JWKS",
    "match": {
-      "url": "<.*>://<.*>/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
@@ -87,12 +87,12 @@
    "id": "hydra-well-known-oidc",
    "description": "Hydra OIDC Discovery & JWKS (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/.well-known/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/.well-known/<.*>",
      "methods": ["GET", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -102,7 +102,7 @@
    "id": "hydra-oauth2",
    "description": "Hydra OAuth2 Endpoints",
    "match": {
-      "url": "<.*>://<.*>/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
@@ -116,12 +116,12 @@
    "id": "hydra-oauth2-oidc",
    "description": "Hydra OAuth2 Endpoints (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/oauth2/<.*>",
+      "url": "<.*>://<[^/]+>/oidc/oauth2/<.*>",
      "methods": ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },
@@ -131,7 +131,7 @@
    "id": "hydra-userinfo",
    "description": "Hydra Userinfo",
    "match": {
-      "url": "<.*>://<.*>/userinfo",
+      "url": "<.*>://<[^/]+>/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
@@ -145,12 +145,12 @@
    "id": "hydra-userinfo-oidc",
    "description": "Hydra Userinfo (with /oidc prefix)",
    "match": {
-      "url": "<.*>://<.*>/oidc/userinfo",
+      "url": "<.*>://<[^/]+>/oidc/userinfo",
      "methods": ["GET", "POST", "OPTIONS"]
    },
    "upstream": {
      "url": "http://hydra:4444",
-      "strip_path_prefix": "/oidc"
+      "strip_path": "/oidc"
    },
    "authenticators": [{ "handler": "noop" }],
    "authorizer": { "handler": "allow" },