keycloak: provide oidc-client, one mesh-made client per consumer

A module that logs people in through Keycloak had to be given a client by
hand, with its secret copied into the consumer's environment. As a provision
the mesh derives the client id (the consumer's identity, mesh_<node>_<module>)
and mints its secret, and delivers both ends: keycloak creates exactly that
confidential client, the consumer names it through ${bound:oidc-client:as}.

The consumer says where its browser comes back to (`callback`) and which
endpoint it is reached on (`label`/`endpoint`), so the redirect is built from
the same names the mesh composes for its route. keycloak serves the issuer and
the endpoint paths under it; the issuer is the one value an assignment sets,
and the realm is read out of it, so consumer and client cannot disagree.

Only what the mesh made is touched: its clients carry mesh.provisioned=true;
a client of the same id without the mark is refused, never adopted, updated
or deleted. The runtime now gets the admin password as a file, which its
tools also needed and never had.

modules/keycloak/module.json

@@ -1,6 +1,12 @@
 {
   "module": "keycloak",
   "version": "1",
+  "provides": [
+    {
+      "name": "oidc-client",
+      "scope": "mesh"
+    }
+  ],
   "requires": [
     "postgres-database",
     "route"
@@ -41,6 +47,20 @@
       "why": "anything the mesh runs that authenticates a person"
     }
   ],
+  "serves": {
+    "oidc-client": {
+      "issuer": "https://keycloak.novox.be/realms/master",
+      "authorization-path": "/protocol/openid-connect/auth",
+      "token-path": "/protocol/openid-connect/token",
+      "userinfo-path": "/protocol/openid-connect/userinfo"
+    }
+  },
+  "receives": {
+    "oidc-client": "/var/lib/keycloak/grants/mesh.json"
+  },
+  "grants": {
+    "oidc-client": "/var/lib/keycloak/grants"
+  },
   "own-secrets": {
     "admin": "/var/lib/keycloak/admin.secret",
     "broker": "/var/lib/mesh/keycloak/broker"
@@ -58,6 +78,12 @@
       "path": "/var/lib/keycloak",
       "mode": "0700"
     },
+    {
+      "id": "grants",
+      "type": "directory",
+      "path": "/var/lib/keycloak/grants",
+      "mode": "0700"
+    },
     {
       "id": "admin-env",
       "type": "file",
@@ -107,7 +133,7 @@
       "type": "file",
       "path": "/var/lib/mesh/keycloak/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"issuer\": \"https://keycloak.novox.be/realms/master\"\n}\n",
       "merge": "json"
     },
     {
@@ -117,12 +143,16 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
+        "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro",
+        "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json"
+        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
+        "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
+        "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json"
       },
       "restart-on": [
         "runtime-config"