BrockCSC visual identity for the third-party UIs execs sign in to, so Keycloak reads as part of brockcsc.ca rather than a stock install.
| Theme | Applies to | Installs at |
|---|---|---|
keycloak/brockcsc |
the brockcsc realm login pages |
the Keycloak themes directory on the VPS |
An extension, not a fork: parent=keycloak.v2 with overrides on top, so upstream security
updates apply without merge conflicts.
tokens.css holds the palette, mirroring app/globals.css in BrockCSC/website. Keycloak never loads
it: it builds its stylesheet list from theme.properties and cannot import from outside the theme,
so brockcsc.css restates the same custom properties.
So a colour change touches both files. Only brockcsc.css renders; tokens.css keeps the club
palette readable next to the website's.
| Primary | #9a4440 |
| Primary, hover | #863a37 — theme only |
| Tint | #fff1f0 |
| Card | 2px black border, 6px 6px 0 0 shadow, 20px radius |
| Control | 10px radius, 3px 3px 0 0 shadow on focus |
| Type | Geist (bundled woff2, latin subset) |
Merging to main runs .github/workflows/deploy.yml: validate, tar, then pipe over SSH to a key
pinned to a forced command on the VPS that can do nothing else.
Keycloak caches themes in production mode, so the container restarts on install: expect a few seconds without sign-in. Hence also no two deploys at once.
After the first deploy, set the realm's login theme:
Keycloak admin → realm brockcsc → Realm settings → Themes → Login theme → brockcsc.
Host, user and known_hosts come from repository variables, the key from a repository secret. Paths
and the container name are at the top of scripts/sync-themes.sh; installing an updated copy on the
VPS is a manual step.
scripts/validate.sh runs on every pull request: structure only, no network, no secrets, because
fork pull requests must never reach credentials. deploy.yml runs on push to main only, so a
contributor PR cannot reach the deploy key.
Verify rendering against a real Keycloak. Selectors track PatternFly v5 as shipped in Keycloak 26.0.8 — re-check after a major upgrade.
See CONTRIBUTING.md.