services:
  auth-db:
    image: postgres:16-alpine
    container_name: auth-db
    restart: unless-stopped
    volumes:
      - auth_pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - auth-network

  auth:
    image: quay.io/keycloak/keycloak:26.1
    container_name: auth
    restart: unless-stopped
    command: start --import-realm
    environment:
      # Database
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://auth-db:5432/${POSTGRES_DB}
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}

      # Hostname & Proxy (Cloudflare Tunnel)
      KC_HOSTNAME: https://auth.mischlabs.de
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: "true"

      # Health & Metrics
      KC_HEALTH_ENABLED: "true"
      KC_METRICS_ENABLED: "true"

      # Bootstrap Admin (only used on first start)
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN_USER}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD}

      # Logging
      KC_LOG_LEVEL: info
    ports:
      - "8180:8080"
      - "9000:9000"
    volumes:
      - ./realm:/opt/keycloak/data/import:ro
    depends_on:
      auth-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000; echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3; timeout 1 cat <&3 | grep -q '200 OK'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - auth-network

volumes:
  auth_pgdata:
    driver: local

networks:
  auth-network:
    driver: bridge