Made keycloak partially init from env variables

also fixed theme to russian

.env

@@ -1,3 +0,0 @@
-POSTGRES_USER=keycloak
-POSTGRES_PASSWORD=changeme
-POSTGRES_DB=keycloak

.env.template

@@ -0,0 +1,21 @@
+POSTGRES_USER=keycloak
+POSTGRES_PASSWORD= !!!changeme
+POSTGRES_DB=keycloak
+REALM_DISPLAY_NAME=QMolSim
+
+# KEYCLOAK NGINX CONFIG
+KEYCLOAK_HOSTNAME=http://auth.example.com
+KEYCLOAK_PORT=80
+
+# KEYCLOAK REALM AND CLIENT CONFIG
+REALM_NAME=quant_sim-realm
+
+FRONTEND_CLIENT_ID=react-frontend
+FRONTEND_CLIENT_NAME="React Frontend"
+FRONTEND_URL=http://frontend.example.com #The base url for accepted redirects
+FRONTEND_HOME_URI=/quantum #The accepted redirect path for logout
+FRONTEND_REDIRECT_PATH=/* #The accepted redirect paths for login
+
+QUANTUM_BACKEND_CLIENT_ID=quantum-backend
+QUANTUM_BACKEND_CLIENT_SECRET= !!!changeme
+QUANTUM_BACKEND_CLIENT_NAME="Quantum Backend"

.gitignore

@@ -1,2 +1,3 @@
 postgres
 keycloakify-starter
+.env

config/00-realm-config.yaml

@@ -0,0 +1,35 @@
+realm: $(REALM_NAME)
+enabled: true
+displayName: $(REALM_DISPLAY_NAME)
+loginTheme: Blue_stripes
+attributes:
+  userProfileEnabled: true
+registrationAllowed: true
+registrationEmailAsUsername: false # Set to true if you want email as username
+editUsernameAllowed: false # Prevent username changes after registration
+
+internationalizationEnabled: true
+defaultLocale: ru
+supportedLocales:
+  - ru
+
+userProfile:
+  attributes:
+    - name: "username"
+      displayName: ${username}
+
+      permissions:
+        view: ["admin", "user"]
+        edit: ["admin", "user"]
+
+    - name: "email"
+      displayName: ${email}
+      required:
+        roles: ["user"]
+      permissions:
+        view: ["admin", "user"]
+        edit: ["admin", "user"]
+      validations:
+        email: {}
+
+  unmanagedAttributePolicy: "ADMIN_VIEW"

config/01-clients-config.yaml

@@ -0,0 +1,22 @@
+realm: $(REALM_NAME)
+clients:
+  - clientId: $(FRONTEND_CLIENT_ID)
+    name: $(FRONTEND_CLIENT_NAME)
+    rootUrl: $(FRONTEND_URL)
+    enabled: true
+    publicClient: true
+    redirectUris:
+      - $(FRONTEND_REDIRECT_PATH)
+    webOrigins:
+      - $(FRONTEND_URL)
+    protocol: openid-connect
+    standardFlowEnabled: true
+    directAccessGrantsEnabled: true
+    attributes:
+      post.logout.redirect.uris: $(FRONTEND_HOME_URI)
+  - clientId: $(QUANTUM_BACKEND_CLIENT_ID)
+    enabled: true
+    name: $(QUANTUM_BACKEND_CLIENT_NAME)
+    secret: $(QUANTUM_BACKEND_CLIENT_SECRET)
+    serviceAccountsEnabled: true
+    publicClient: false

config/02-users-config.yaml

@@ -0,0 +1,10 @@
+realm: $(REALM_NAME)
+
+users:
+  - username: service-account-$(QUANTUM_BACKEND_CLIENT_ID)
+    enabled: true
+    serviceAccountClientId: $(QUANTUM_BACKEND_CLIENT_ID)
+    clientRoles:
+      realm-management:
+        - view-users
+        - query-users

docker-compose.yml

@@ -1,18 +1,18 @@
 services:
   keycloak:
-    image: keycloak/keycloak:26.1
+    image: keycloak/keycloak:26.5.5
     container_name: keycloak
     environment:
       KC_BOOTSTRAP_ADMIN_USERNAME: admin
       KC_BOOTSTRAP_ADMIN_PASSWORD: admin # temporay password to change when first time logged in
       KC_DB: postgres
-      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
+      KC_DB_URL: jdbc:postgresql://keycloak-postgres:5432/${POSTGRES_DB}
       KC_DB_USERNAME: ${POSTGRES_USER}
       KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
       KC_METRICS_ENABLED: "true"
       KC_HEALTH_ENABLED: "true"
       KC_LOG_LEVEL: INFO
-      KC_HOSTNAME: http://auth.localhost
+      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
       KC_PROXY: edge
       KC_HTTP_ENABLED: "true"
     volumes:
@@ -20,6 +20,15 @@ services:
     depends_on:
       keycloak-database:
         condition: service_healthy
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          '[ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { public static void main(String[] args) throws java.lang.Throwable { System.exit(java.net.HttpURLConnection.HTTP_OK == ((java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection()).getResponseCode() ? 0 : 1); } }" > /tmp/HealthCheck.java && java /tmp/HealthCheck.java http://localhost:9000/health/live',
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 30
     command:
       - start-dev
       - --http-enabled=true
@@ -27,7 +36,7 @@ services:
 
   keycloak-database:
     image: postgres:17
-    container_name: postgres
+    container_name: keycloak-postgres
     environment:
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
@@ -35,17 +44,37 @@ services:
     volumes:
       - ./postgres/data:/var/lib/postgresql/data # save data in a volume
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
       interval: 10s
       timeout: 5s
       retries: 5
-
   nginx:
-    image: nginx
+    image: nginx:1.23.1-alpine
     container_name: nginx
+    environment:
+      KEYCLOAK_HOSTNAME: ${KEYCLOAK_HOSTNAME}
+      KEYCLOAK_PORT: ${KEYCLOAK_PORT}
     ports:
       - 80:80
     volumes:
-      - ./nginx/conf.d:/etc/nginx/conf.d
+      - ./nginx/keycloak.conf:/etc/nginx/templates/default.conf.template
     depends_on:
       - keycloak
+
+  keycloak-config-cli:
+    image: adorsys/keycloak-config-cli:6.5.0-26
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    environment:
+      KEYCLOAK_URL: "http://keycloak:8080"
+      KEYCLOAK_USER: admin
+      KEYCLOAK_PASSWORD: admin
+      IMPORT_FILES_LOCATIONS: "/config/*.yaml"
+      IMPORT_VAR_SUBSTITUTION_ENABLED: "true"
+      IMPORT_STATE: "true" # Enable remote state management
+      IMPORT_VALIDATE: "true" # Enable remote state management
+    volumes:
+      - ./config:/config
+    env_file:
+      - .env

nginx/keycloak.conf

@@ -1,10 +1,11 @@
+
 upstream keycloak {
     server keycloak:8080;
 }
 
 server {
-    server_name auth.localhost;
+    server_name ${KEYCLOAK_HOSTNAME};
-    listen 80;
+    listen ${KEYCLOAK_PORT};
 
     # deny access to home page
     # exposed path recommendations https://www.keycloak.org/server/reverseproxy#_exposed_path_recommendations