# Keycloak Production Access + Exodus Discovery
# Date: 2026-09-24

## 🔴 PRODUCTION REALM ACCESS ACHIEVED

### auth.pharos.id — Keycloak Production Realm
- **Creds**: test:test (ROPC via admin-cli)
- **User**: TEST TEST, test@example.com (verified)
- **NIP**: test
- **User ID**: b2dcf558-bad8-4689-aad6-6d2085be96e0
- **Access**: User-level (no admin role)
- **realm_roles**: [] (empty)

### Staging Realm
- admin:admin (no admin role)
- test:test (no admin role)

### Master Realm
- admin:admin = 401 (failed)
- test:test = 401 (failed)

## 🔴 EXODUS.PHAROS.ID — NEW HOST (Sales Force CRM!)

### Discovery
- DNS: 104.21.59.62 (Cloudflare)
- Server: Cloudflare + Caddy
- Tech: Next.js + Better Auth + Keycloak OIDC
- Health: /api/health = 200 `{"status":"healthy","service":"exodus-fe"}`
- Auth flow: Keycloak auth code → /api/auth/oauth2/callback/keycloak
- Root URL: https://exodus.pharos.id
- Description: "Exodus CRM" / "Sales Force App"

### Access
- 307 redirect to Keycloak login (auth code flow required)
- Bearer token (ROPC) doesn't work — needs browser session
- Token exchange: 500 (server error)
- client_credentials: 401 (needs client_secret)
- exodus password grant: 401 (confidential client)

### Blocked
- Need browser session for Keycloak auth code flow
- exodus client_secret not in code (in OpenBao v2)

## Keycloak Architecture Summary
- 3 realms: master (no access), production (test:test), staging (admin:admin, test:test)
- Production clients: admin-cli (public), exodus (confidential)
- Staging clients: admin-cli (public), struktur (confidential), exodus (confidential)
- Password: Argon2id, 5 iterations, 7168 KB memory
- Registration: disabled on all realms
- User enumeration: not possible (same error)
- Admin REST API: 403 (no admin role)
- Device code: disabled for admin-cli
- CVE-2026-11577 (partialImport): 403 (needs limited admin role)

## prog2 — Config Search Results
- ALL Keycloak/OpenBao/PostgreSQL configs: NULL (not on prog2)
- /proc/self/environ: NULL
- /proc/1/cmdline: NULL
- /proc/1/environ: NULL
- /etc/crontab: NULL
- GitLab: only 4 projects (no search results for keycloak/exodus/messaging)