4.1 Prepare DNS, HTTPS and OIDC

Configure the external issuer and the gateway's browser and MCP client registrations before exposing public endpoints. For Keycloak, the issuer typically looks like https://identity.example.com/realms/openepm. Use the discovery document to verify the exact issuer and key endpoint.

OIDC_ISSUER="https://identity.example.com/realms/openepm"
curl --fail --silent --show-error "$OIDC_ISSUER/.well-known/openid-configuration"

Compare the returned issuer and jwks_uri to the protected configuration. Set distinct browser and MCP access-token audiences. Verify that a token from each client has the intended audience and a stable sub. Keep tokens out of logs and tickets.

Use the discovered HTTPS jwks_uri as EPM_OIDC_JWKS_URL. The listener containers must be able to resolve and reach it over HTTPS. Their readiness probe requires a usable RSA signing key of at least 2,048 bits for RS256 and does not follow redirects. A placeholder or unreachable key URL leaves the listeners unhealthy even when the database and worker are ready.

Set DNS and certificates for the web and MCP origins at the gateway. The development Compose project does not supply the gateway, session storage or native Keycloak. The pinned deploy/release templates define a separate packaged topology with those components and require signed, immutable release artifacts.