✨(helm) redirecting system #1697

AntoLC · 2025-12-05T15:45:47Z

Purpose

We want to replace the LaSuite Docs landing page (https://docs.numerique.gouv.fr/home/) by the new one (https://lasuite.numerique.gouv.fr/produits/docs).
We will redirect to it if the app targets /home/ page.
To target only our instance it will be configurable thanks to the helm charts.

How to use

In your env.d folder set the ingressRedirects as you want, it can be a array of redirections, redirecting with a special code (default code 301):

example: ./src/helm/env.d/feature/values.impress.yaml.gotmpl

ingressRedirects:
  enabled: true
  defaultHost: {{ .Values.feature }}-docs.{{ .Values.domain }}
  rules:
    - name: home        
      from: /home
      to: https://lasuite.numerique.gouv.fr/produits/docs
    - name: visio        
      from: /visio
      to: https://lasuite.numerique.gouv.fr/produits/visio
    - name: error-404        
      from: /404
      to: https://lasuite.numerique.gouv.fr/404
      code: 404

github-actions · 2025-12-05T15:46:32Z

🚀 Preview will be available at https://1697-docs.ppr-docs.beta.numerique.gouv.fr/

You can use the existing account with these credentials:

username: docs
password: docs

You can also create a new account if you want to.

Once this Pull Request is merged, the preview will be destroyed.

When clicking on "Se Connecter", the url is the production one (https://docs.numerique.gouv.fr/api/v1.0/authenticate/).

If you want to go inside the preview app, here is the url: https://1697-docs.ppr-docs.beta.numerique.gouv.fr/api/v1.0/authenticate/

github-actions · 2025-12-05T15:53:06Z

Size Change: -23 B (0%)

Total Size: 4.14 MB

Filename	Size	Change
`apps/impress/out/_next/static/822b1238/_buildManifest.js`	0 B	-903 B (removed)	🏆
`apps/impress/out/_next/static/bdadfada/_buildManifest.js`	903 B	+903 B (new file)	🆕

_{compressed-size-action}

lunika · 2025-12-15T09:33:32Z

src/helm/impress/templates/ingress-redirects.yaml

+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      return {{ $r.code }} {{ $to }};


Why not using nginx.ingress.kubernetes.io/temporal-redirect annotation ? We would like to avoid usage of configuration-snippet annotation

I agree with @lunika

You should manage the return code with the specific annotation instead of using configuration-snippet

rouja · 2025-12-15T10:10:09Z

src/helm/impress/templates/ingress-redirects.yaml

+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      return {{ $r.code }} {{ $to }};


I agree with @lunika

You should manage the return code with the specific annotation instead of using configuration-snippet

rouja · 2025-12-15T10:13:02Z

src/helm/impress/templates/ingress-redirects.yaml

+            name: {{ include "impress.frontend.fullname" $ }}
+            port:
+              number: {{ $.Values.frontend.service.port }}
+---


I prefer when the TLS configuration is explicit, because right now HTTPS is working thanks to other ingress.

Have a look in the fixup commits if it seems ok. Feel free to improve if it needs. 🙏

To be intercepted by ingress redirects, we need to redirect using window.location instead of using Next.js router. The Next.js router does not trigger a full page reload, so the ingress redirect logic is not executed.

Create a new Helm template for ingress redirects and update the values.yaml file accordingly. We will be able to manage ingress redirects through Helm charts easily.

Add OIDC_REDIRECT_ALLOWED_HOSTS setting to dev and feature environments to properly allow Keycloak redirect callbacks after authentication.

Replace custom OIDC scopes with standard OpenID Connect scopes to fix Keycloak authentication flow. Changes: - Replace OIDC_RP_SCOPES from "openid email given_name usual_name" to "openid email profile" - Update OIDC_USERINFO_FULLNAME_FIELDS from "given_name,usual_name" to "given_name,family_name" - Add OIDC_REDIRECT_ALLOWED_HOSTS to allow Keycloak callback redirects The previous configuration used custom scopes (given_name, usual_name) that were not configured in Keycloak, causing authentication to fail with "invalid_scope" error. Using the standard "profile" scope includes all necessary user claims (given_name, family_name, etc.) and works with default Keycloak configuration. This fixes the issue where users were redirected to /home after authentication instead of staying logged in, because the OIDC flow was failing and session cookies were not being set properly.

lunika · 2025-12-16T09:49:18Z

src/helm/impress/values.yaml

    nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"
    nginx.ingress.kubernetes.io/upstream-hash-by: $arg_room

+ingressRedirects:


You have to add the documentation before thisblock (take a look at the other) and then run

$ cd src/helm/impress $ ./generate-readme.sh

AntoLC self-assigned this Dec 5, 2025

AntoLC added frontend feature add a new feature preview labels Dec 5, 2025

AntoLC added the FAST Issues that will improve the AARR (acquisition, activation, retention and recommendation) label Dec 5, 2025

AntoLC force-pushed the feat/new-home branch 2 times, most recently from a458cf8 to 77adea5 Compare December 9, 2025 16:38

AntoLC marked this pull request as draft December 9, 2025 17:13

AntoLC force-pushed the feat/new-home branch from 59917b3 to ab1b179 Compare December 10, 2025 20:32

AntoLC linked an issue Dec 10, 2025 that may be closed by this pull request

♻️ Replace old Docs landing by the new one #1692

Open

AntoLC force-pushed the feat/new-home branch 3 times, most recently from dbba4a3 to 3b0cfce Compare December 11, 2025 09:06

AntoLC changed the title ~~♻️ Replace old Docs landing by the new one~~ ✨(helm) redirecting system Dec 11, 2025

AntoLC force-pushed the feat/new-home branch from 3b0cfce to 54dd83c Compare December 11, 2025 09:11

AntoLC marked this pull request as ready for review December 11, 2025 09:11

AntoLC requested review from lunika and rouja December 11, 2025 09:21

AntoLC added the helm label Dec 11, 2025

lunika reviewed Dec 15, 2025

View reviewed changes

rouja reviewed Dec 15, 2025

View reviewed changes

AntoLC force-pushed the feat/new-home branch from 54dd83c to 21f51b2 Compare December 15, 2025 13:54

AntoLC added 3 commits December 15, 2025 15:43

♻️(frontend) replace auth redirect logic for home

f0dae52

To be intercepted by ingress redirects, we need to redirect using window.location instead of using Next.js router. The Next.js router does not trigger a full page reload, so the ingress redirect logic is not executed.

✨(helm) create ingress-redirects template

6be9978

Create a new Helm template for ingress redirects and update the values.yaml file accordingly. We will be able to manage ingress redirects through Helm charts easily.

testing-purpose-will-not-be-merged

dc4f84a

AntoLC force-pushed the feat/new-home branch 3 times, most recently from f3d32c3 to dc4f84a Compare December 15, 2025 15:07

AntoLC force-pushed the feat/new-home branch 3 times, most recently from 5590418 to bddada1 Compare December 15, 2025 15:39

AntoLC added 4 commits December 15, 2025 16:44

fixup! ✨(helm) create ingress-redirects template

f8b3cbe

fixup! testing-purpose-will-not-be-merged

593ea27

🔧(helm) add OIDC_REDIRECT_ALLOWED_HOSTS to fix authentication flow

8f8d467

Add OIDC_REDIRECT_ALLOWED_HOSTS setting to dev and feature environments to properly allow Keycloak redirect callbacks after authentication.

AntoLC force-pushed the feat/new-home branch from bddada1 to e9ef806 Compare December 15, 2025 15:44

suitenumerique deleted a comment from github-actions bot Dec 15, 2025

AntoLC requested review from lunika and rouja December 15, 2025 16:00

lunika reviewed Dec 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

✨(helm) redirecting system #1697

✨(helm) redirecting system #1697

Uh oh!

AntoLC commented Dec 5, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 5, 2025 •

edited by AntoLC

Loading

Uh oh!

github-actions bot commented Dec 5, 2025 •

edited

Loading

Uh oh!

lunika Dec 15, 2025

Uh oh!

rouja Dec 15, 2025

Uh oh!

rouja Dec 15, 2025

Uh oh!

rouja Dec 15, 2025

Uh oh!

AntoLC Dec 15, 2025

Uh oh!

lunika Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		nginx.ingress.kubernetes.io/configuration-snippet: \|
		return {{ $r.code }} {{ $to }};

✨(helm) redirecting system #1697

Are you sure you want to change the base?

✨(helm) redirecting system #1697

Uh oh!

Conversation

AntoLC commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

How to use

Uh oh!

github-actions bot commented Dec 5, 2025 • edited by AntoLC Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lunika Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

rouja Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

rouja Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

rouja Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

AntoLC Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

lunika Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AntoLC commented Dec 5, 2025 •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited by AntoLC

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading