mi
62 lines
2.4 KiB
YAML
62 lines
2.4 KiB
YAML
services:
|
|
keycloak:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: han-chat/keycloak:26.1.4-otp-1.0.0
|
|
command: ["start", "--optimized", "--import-realm"]
|
|
environment:
|
|
KC_DB: postgres
|
|
KC_DB_URL: ${KEYCLOAK_DB_URL:?KEYCLOAK_DB_URL is required}
|
|
KC_DB_URL_PROPERTIES: ${KC_DB_URL_PROPERTIES:-currentSchema=keycloak}
|
|
KC_HOSTNAME: ${KEYCLOAK_PUBLIC_URL:-https://tohin.ru/auth}
|
|
KC_HOSTNAME_STRICT: "true"
|
|
KC_HTTP_ENABLED: "true"
|
|
KC_HTTP_PORT: "8080"
|
|
KC_HTTP_RELATIVE_PATH: /auth
|
|
KC_PROXY_HEADERS: xforwarded
|
|
KC_HEALTH_ENABLED: "true"
|
|
KC_METRICS_ENABLED: "true"
|
|
KC_HTTP_MANAGEMENT_PORT: "9000"
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME:?bootstrap admin username is required}
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD:?bootstrap admin password is required}
|
|
KEYCLOAK_OTP_MOCK_ENABLED: ${KEYCLOAK_OTP_MOCK_ENABLED:-true}
|
|
KEYCLOAK_OTP_MOCK_CODE: ${KEYCLOAK_OTP_MOCK_CODE:?mock code is required}
|
|
KEYCLOAK_OTP_HMAC_KEY: ${KEYCLOAK_OTP_HMAC_KEY:?OTP HMAC key is required}
|
|
KEYCLOAK_OTP_TTL_SEC: ${KEYCLOAK_OTP_TTL_SEC:-300}
|
|
KEYCLOAK_OTP_MAX_VERIFY_ATTEMPTS: ${KEYCLOAK_OTP_MAX_VERIFY_ATTEMPTS:-5}
|
|
KEYCLOAK_OTP_SETTINGS_MAX_STALE_SEC: ${KEYCLOAK_OTP_SETTINGS_MAX_STALE_SEC:-300}
|
|
KEYCLOAK_SETTINGS_BRIDGE_URL: ${KEYCLOAK_SETTINGS_BRIDGE_URL:-http://api-backend:8000/internal/settings/v1/otp}
|
|
KEYCLOAK_SETTINGS_BRIDGE_TOKEN: ${KEYCLOAK_SETTINGS_BRIDGE_TOKEN:?settings bridge token is required}
|
|
KC_LOG_CONSOLE_OUTPUT: json
|
|
KC_LOG_LEVEL: ${KEYCLOAK_LOG_LEVEL:-INFO}
|
|
JAVA_OPTS_APPEND: ${KEYCLOAK_JAVA_OPTS:--XX:MaxRAMPercentage=70 -XX:InitialRAMPercentage=35}
|
|
expose:
|
|
- "8080"
|
|
- "9000"
|
|
networks:
|
|
- public
|
|
- backend
|
|
- observability
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '200 OK' <&3"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 12
|
|
start_period: 60s
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1770
|
|
- /opt/keycloak/data/tmp:size=64m,uid=1000,gid=0,mode=0770
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
stop_grace_period: 30s
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
public:
|
|
backend:
|
|
observability:
|