From 292ad638df0203281cda0630be672c47500811b7 Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 15:25:42 +0900
Subject: [PATCH 1/6] fix(iam-nginx): resolve upstream hosts at request time to
 prevent clean-install crash loop

On a fresh install the IAM/KC proxy blocks resolved their upstream
hostnames at config-parse time, so nginx died with [emerg] host not
found before the mc-iam-manager container existed. Switch the four
static proxy_pass directives to the resolver + variable pattern already
used by the other server blocks so nginx starts regardless of container
startup order.

The /auth/ block drops its literal URI: with a variable proxy_pass a
literal URI replaces the entire request path, which would break
/auth/realms/* subpaths (also fixed in the local template where this
latent defect already existed).
---
 .../conf/mc-iam-manager/nginx.template.conf    | 18 ++++++++++++++----
 .../mc-iam-manager/nginx.template.local.conf   |  4 +++-
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/conf/docker/conf/mc-iam-manager/nginx.template.conf b/conf/docker/conf/mc-iam-manager/nginx.template.conf
index 0a70e6b..f7dc69d 100644
--- a/conf/docker/conf/mc-iam-manager/nginx.template.conf
+++ b/conf/docker/conf/mc-iam-manager/nginx.template.conf
@@ -53,7 +53,9 @@ http {
 
         # Health check endpoint (accessible over HTTP)
         location /health {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -100,7 +102,9 @@ http {
 
         # Health check endpoint (accessible over HTTPS as well)
         location /health {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -115,7 +119,9 @@ http {
         }
 
         location / {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT};
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -130,7 +136,11 @@ http {
         }
 
         location /auth/ {
-            proxy_pass http://mc-iam-manager-kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN};
+            # No URI on variable proxy_pass: the original request URI is passed
+            # through unchanged (a literal URI here would replace the whole path)
+            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
diff --git a/conf/docker/conf/mc-iam-manager/nginx.template.local.conf b/conf/docker/conf/mc-iam-manager/nginx.template.local.conf
index 4b716f8..401872a 100644
--- a/conf/docker/conf/mc-iam-manager/nginx.template.local.conf
+++ b/conf/docker/conf/mc-iam-manager/nginx.template.local.conf
@@ -60,7 +60,9 @@ http {
         location /auth/ {
             resolver 127.0.0.11 valid=10s;
             set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN};
-            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/;
+            # No URI on variable proxy_pass: the original request URI is passed
+            # through unchanged (a literal URI here would replace the whole path)
+            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

From dc56a7d5bb58e4f0135d6d392c69ef8a70a92c29 Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 15:26:16 +0900
Subject: [PATCH 2/6] fix(compose): drop mc-iam-manager dependency on nginx to
 break startup deadlock

mc-iam-manager waited for mc-iam-manager-nginx (service_started) while
nginx itself could not start until the mc-iam-manager DNS name existed,
leaving both stuck on a fresh install. The IAM manager has no startup
dependency on nginx (Keycloak and its own healthcheck are reached
directly), and the standalone mc-iam-manager repository already runs
with this dependency removed.
---
 conf/docker/docker-compose.mini.yaml | 1 -
 conf/docker/docker-compose.yaml      | 2 --
 2 files changed, 3 deletions(-)

diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml
index f9bd3b4..d995cae 100644
--- a/conf/docker/docker-compose.mini.yaml
+++ b/conf/docker/docker-compose.mini.yaml
@@ -232,7 +232,6 @@ services:
     depends_on:
       - mc-iam-manager-db
       - mc-iam-manager-kc
-      - mc-iam-manager-nginx
     environment:
       DATABASE_URL: postgres://${MC_IAM_MANAGER_DATABASE_USER}:${MC_IAM_MANAGER_DATABASE_PASSWORD}@${MC_IAM_MANAGER_DATABASE_HOST}:5432/${MC_IAM_MANAGER_DATABASE_NAME}
       PORT: ${MC_IAM_MANAGER_PORT}
diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml
index 1390da4..fcbcee8 100644
--- a/conf/docker/docker-compose.yaml
+++ b/conf/docker/docker-compose.yaml
@@ -259,8 +259,6 @@ services:
         condition: service_healthy
       mc-iam-manager-kc:
         condition: service_healthy
-      mc-iam-manager-nginx:
-        condition: service_started
       mc-infra-manager:
         condition: service_healthy
     environment:

From c35b0cc3fb998fa000e39b9e1a691d79e30280ae Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 15:26:45 +0900
Subject: [PATCH 3/6] feat(compose): add healthcheck to mc-iam-manager-nginx

Uses the /nginx-health endpoint already served by the templates so a
crash-looping or misconfigured nginx is visible in compose ps instead
of reporting plain Up. No service depends on nginx being healthy, so
startup ordering is unaffected.
---
 conf/docker/docker-compose.mini.yaml | 3 +++
 conf/docker/docker-compose.yaml      | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml
index d995cae..5c6d4e8 100644
--- a/conf/docker/docker-compose.mini.yaml
+++ b/conf/docker/docker-compose.mini.yaml
@@ -325,6 +325,9 @@ services:
       - ./container-volume/certbot/www:/var/www/certbot:ro
     depends_on:
       - mc-iam-manager-kc
+    healthcheck:
+      test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ]
+      <<: *default-health-check
     networks:
       - mc-iam-manager-network
 
diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml
index fcbcee8..b67632e 100644
--- a/conf/docker/docker-compose.yaml
+++ b/conf/docker/docker-compose.yaml
@@ -365,6 +365,9 @@ services:
       - ./container-volume/certbot/www:/var/www/certbot:ro
     depends_on:
       - mc-iam-manager-kc
+    healthcheck:
+      test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ]
+      <<: *default-health-check
     networks:
       - mc-iam-manager-network
       - mc-observability-network

From 40f3be7fa05d36062b10d06bbaad695e4b687cc6 Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 15:27:08 +0900
Subject: [PATCH 4/6] fix(preset): substitute MC_OBSERVABILITY_FRONT_PORT in
 local nginx preset

The dev/prod preset scripts gained this substitution earlier but the
local script was missed, leaving a literal ${MC_OBSERVABILITY_FRONT_PORT}
listen directive in the generated nginx.conf and failing nginx startup
in local mode.
---
 conf/docker/conf/mc-iam-manager/0_preset_local.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/docker/conf/mc-iam-manager/0_preset_local.sh b/conf/docker/conf/mc-iam-manager/0_preset_local.sh
index 0cbfd2b..3a775f6 100755
--- a/conf/docker/conf/mc-iam-manager/0_preset_local.sh
+++ b/conf/docker/conf/mc-iam-manager/0_preset_local.sh
@@ -220,6 +220,7 @@ if [ -n "$MC_IAM_MANAGER_PUBLIC_DOMAIN" ] && [ -n "$MC_IAM_MANAGER_KEYCLOAK_PORT
         -e "s/\${MC_WORKFLOW_MANAGER_PROXY_PORT}/$MC_WORKFLOW_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_DATA_MANAGER_PROXY_PORT}/$MC_DATA_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_APPLICATION_MANAGER_PROXY_PORT}/$MC_APPLICATION_MANAGER_PROXY_PORT/g" \
+        -e "s/\${MC_OBSERVABILITY_FRONT_PORT}/$MC_OBSERVABILITY_FRONT_PORT/g" \
         "$TEMPLATE_FILE" > "$OUTPUT_FILE"
     echo "✓ nginx.conf generated (HTTP mode)"
 else

From 60b134301ec69eb9b6453e4f1485eccdc745ac7c Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 15:29:26 +0900
Subject: [PATCH 5/6] fix(preset): substitute MC_IAM_MANAGER_DOMAIN in prod
 nginx preset

The prod preset read MC_IAM_MANAGER_DOMAIN but never applied it to the
generated nginx.conf. This was a no-op while the template hardcoded the
container hostname; with the resolver/variable pattern the token must be
substituted or nginx fails to parse the config.
---
 conf/docker/conf/mc-iam-manager/0_preset_prod.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/conf/docker/conf/mc-iam-manager/0_preset_prod.sh b/conf/docker/conf/mc-iam-manager/0_preset_prod.sh
index 9a25bb6..780ff4d 100755
--- a/conf/docker/conf/mc-iam-manager/0_preset_prod.sh
+++ b/conf/docker/conf/mc-iam-manager/0_preset_prod.sh
@@ -62,6 +62,13 @@ echo "  MC_COST_OPTIMIZER_FE_PROXY_PORT: $MC_COST_OPTIMIZER_FE_PROXY_PORT"
 # Copy template file and substitute environment variables
 cp "$TEMPLATE_FILE" "$OUTPUT_FILE" || { echo "Error: Failed to copy template file: $TEMPLATE_FILE → $OUTPUT_FILE"; exit 1; }
 
+if [ -n "$MC_IAM_MANAGER_DOMAIN" ]; then
+    sed -i "s/\${MC_IAM_MANAGER_DOMAIN}/$MC_IAM_MANAGER_DOMAIN/g" "$OUTPUT_FILE"
+    echo "✓ MC_IAM_MANAGER_DOMAIN substitution done: $MC_IAM_MANAGER_DOMAIN"
+else
+    echo "Warning: MC_IAM_MANAGER_DOMAIN environment variable is not set."
+fi
+
 if [ -n "$MC_IAM_MANAGER_PORT" ]; then
     sed -i "s/\${MC_IAM_MANAGER_PORT}/$MC_IAM_MANAGER_PORT/g" "$OUTPUT_FILE"
     echo "✓ MC_IAM_MANAGER_PORT substitution done: $MC_IAM_MANAGER_PORT"

From b740ed0bd6eb3e5df5f63e8dcbfa5a650e4f5f20 Mon Sep 17 00:00:00 2001
From: yh-noh <yhnoh@mz.co.kr>
Date: Fri, 7 Aug 2026 16:11:11 +0900
Subject: [PATCH 6/6] fix(install): start mc-iam-manager-nginx explicitly in
 wave 1

nginx was only ever started as a side effect of mc-iam-manager's
compose dependency. With that dependency removed, no wave listed nginx,
so a fresh install brought up the IAM manager without its public-domain
endpoints and it never became healthy. List nginx in wave 1 ahead of
the IAM manager.
---
 bin/installAll.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/bin/installAll.sh b/bin/installAll.sh
index 7f0434d..5691113 100755
--- a/bin/installAll.sh
+++ b/bin/installAll.sh
@@ -157,8 +157,12 @@ EXIT_STREAK_THRESHOLD=3
 # depends_on chain automatically (already-running dependencies are a no-op).
 # mc-application-manager/mc-cost-optimizer-* depend on mc-observability-rabbitmq,
 # so the observability backbone wave runs before the app-tier wave.
+# mc-iam-manager-nginx is listed explicitly: mc-iam-manager no longer declares a
+# compose dependency on it (that dependency caused a startup deadlock), but the
+# IAM manager still needs the public-domain endpoints nginx serves to become
+# healthy, so nginx must start in the same wave.
 STARTUP_WAVES=(
-    "mc-infra-connector mc-infra-manager mc-iam-manager mc-iam-manager-post-initial"
+    "mc-infra-connector mc-infra-manager mc-iam-manager-nginx mc-iam-manager mc-iam-manager-post-initial"
     "mc-data-manager mc-web-console-api mc-web-console-front"
     "mc-observability-manager mc-observability-front mc-observability-insight mc-observability-insight-scheduler mc-observability-mcp-grafana mc-observability-mcp-maria mc-observability-mcp-influx mc-observability-log-collector"
     "mc-application-manager mc-workflow-manager mc-cost-optimizer-fe"