URL: https://auth.house-of-trae.com — 10 realms, all with MFA enforced, brute-force detection, strong password policy.
| Realm | Used by |
|---|---|
| securenexus | Grafana, Forgejo, PowerDNS-Admin, general HoT staff tooling (incl. this wiki) |
| privatenexus | PrivateNexus app users |
| house-of-trae | Parent — master identity-provider-redirector broker |
| byrne-accounts / stratus-digital / discreet-elite / emerald-markets / clients | Per-entity realms |
| master | Keycloak's own admin realm |
Gotcha: the OIDC API URL must point to the realm root (.../realms/<realm>), never the protocol endpoint directly — using the wrong one causes silent 500s.
API port 8081 (not 8053). Authoritative nameservers: ns1/ns2.house-of-trae.com. 13 zones managed, including house-of-trae.com, securenexus.net, privatenexus.net, and each client-entity domain.
Decommission rule: when a service is torn down, delete its DNS records — the specific name and any wildcard that could backfill it — the same day. This has bitten the project twice on two different domains from not doing this promptly.
securenexus.nethouse-of-trae.com (hard technical constraint — the shared oauth2-proxy's CSRF cookie can't cross to a securenexus.net callback)privatenexus.nethouse-of-trae.comHost: mail.house-of-trae.com, webmail at webmail.house-of-trae.com (Docker Mailserver + Roundcube). Universal SMTP: notifications@house-of-trae.com, port 587 STARTTLS.