Setting up a new client VPS (194.164.95.50) for a B2B fresh produce business requiring a web-based database with role-based access control, similar to the GP Booking App architecture.
- IP:
194.164.95.50
- User:
root
- SSH Key: ed25519 key deployed for the opencode agent
- System updates & upgrades applied
- UFW firewall (SSH, HTTP, HTTPS allowed)
- Docker Engine (29.6.2) + Docker Compose plugin (5.3.1)
- Docker network:
client-infra (bridge, 172.18.0.0/16)
- Nginx reverse proxy (port 80 → Wiki.js on 3002)
- unattended-upgrades configured
- Base packages: curl, wget, git, certbot, python3, nodejs
- Single container serving all services
- Databases created:
wikijs, forgejo, keycloak
- Credentials stored in
/opt/postgres/pw.txt
- Realm:
ixg
- Admin console: http://194.164.95.50:8443/admin/master/console/
- OIDC clients configured:
wikijs, forgejo
- SSL requirement: disabled (HTTP only — no domain yet)
- Users created: testuser, matthew_ixg, peter
- Admin credentials stored in
/opt/postgres/kc-admin-pw.txt
- URL: http://194.164.95.50
- Local admin: admin@ixg.local / Admin123!
- Keycloak SSO configured (native keycloak strategy)
- System prompt page created:
agents/vps-system-prompt
- Management script:
/opt/wiki-manage.py
/opt/kcadmin.sh — Keycloak admin CLI wrapper/opt/wiki-manage.py — Wiki.js page management via DB
- Keycloak authentication redirects to Wiki.js callback
- JWT session cookie is created successfully
- Self-registration creates Wiki.js users automatically
- Auto-enroll in Administrators group for new SSO users
- Wiki.js local auth also works via
/auto-login
The user matthew_ixg cannot log in via Keycloak SSO — the redirect back to Wiki.js fails. Other users (testuser) work fine. The issue is being investigated. Root cause appears to be related to:
- Keycloak 26 compatibility with the
@exlinc/keycloak-passport passport strategy
- Issuer validation mismatch when using mixed internal/external URLs
- Currently using host-level iptables DNAT to make the external URL reachable from the Wiki.js container
- Resolve matthew_ixg SSO login issue
- Add domain names once transferred to Fasthosts
- Configure SSL certificates via certbot
- Set up Watchtower for automatic Docker container updates
- Begin application architecture planning for the web-based database with RBAC