---
services:
  postgres:
    image: postgres:17-alpine
    networks:
      opencloud-net:
    volumes:
      - keycloak_postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: ${KC_DB_USERNAME:-keycloak}
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always

  keycloak:
    image: quay.io/keycloak/keycloak:26.3.3
    networks:
      opencloud-net:
    command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]
    entrypoint: [ "/bin/sh", "/opt/keycloak/bin/docker-entrypoint-override.sh" ]
    volumes:
      - "./config/keycloak/docker-entrypoint-override.sh:/opt/keycloak/bin/docker-entrypoint-override.sh"
      - "./config/keycloak/opencloud-realm-autoprovisioning.dist.json:/opt/keycloak/data/import-dist/openCloud-realm.json"
      - "./config/keycloak/themes/opencloud:/opt/keycloak/themes/opencloud"
    environment:
      OC_DOMAIN: ${OC_DOMAIN:-cloud.opencloud.test}
      KC_HOSTNAME: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}
      KC_DB: postgres
      KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak"
      KC_DB_USERNAME: ${KC_DB_USERNAME:-keycloak}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
      KC_FEATURES: impersonation
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: true
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-kcadmin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
    depends_on:
      - postgres
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always

volumes:
  keycloak_postgres_data: