8a4beb879a
Keycloak 26.1 + PostgreSQL 16 Docker stack with pre-configured realm containing 10 OIDC clients for all MischLabs services. Includes integration guides for Tier 1-3 services. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
71 lines
1.8 KiB
YAML
71 lines
1.8 KiB
YAML
services:
|
|
auth-db:
|
|
image: postgres:16-alpine
|
|
container_name: auth-db
|
|
restart: unless-stopped
|
|
volumes:
|
|
- auth_pgdata:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- auth-network
|
|
|
|
auth:
|
|
image: quay.io/keycloak/keycloak:26.1
|
|
container_name: auth
|
|
restart: unless-stopped
|
|
command: start --import-realm
|
|
environment:
|
|
# Database
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://auth-db:5432/${POSTGRES_DB}
|
|
KC_DB_USERNAME: ${POSTGRES_USER}
|
|
KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
|
|
|
|
# Hostname & Proxy (Cloudflare Tunnel)
|
|
KC_HOSTNAME: https://auth.mischlabs.de
|
|
KC_PROXY_HEADERS: xforwarded
|
|
KC_HTTP_ENABLED: "true"
|
|
|
|
# Health & Metrics
|
|
KC_HEALTH_ENABLED: "true"
|
|
KC_METRICS_ENABLED: "true"
|
|
|
|
# Bootstrap Admin (only used on first start)
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN_USER}
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD}
|
|
|
|
# Logging
|
|
KC_LOG_LEVEL: info
|
|
ports:
|
|
- "8180:8080"
|
|
- "9000:9000"
|
|
volumes:
|
|
- ./realm:/opt/keycloak/data/import:ro
|
|
depends_on:
|
|
auth-db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000; echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3; timeout 1 cat <&3 | grep -q '200 OK'"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
networks:
|
|
- auth-network
|
|
|
|
volumes:
|
|
auth_pgdata:
|
|
driver: local
|
|
|
|
networks:
|
|
auth-network:
|
|
driver: bridge
|