services:
  keycloak:
    image: keycloak/keycloak:26.5.5
    container_name: keycloak
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin # temporay password to change when first time logged in
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-postgres:5432/${POSTGRES_DB}
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_METRICS_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      KC_LOG_LEVEL: INFO
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      KC_PROXY: edge
      KC_HTTP_ENABLED: "true"
    volumes:
      - ./keycloak/themes:/opt/keycloak/providers/
    depends_on:
      keycloak-database:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD-SHELL",
          '[ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { public static void main(String[] args) throws java.lang.Throwable { System.exit(java.net.HttpURLConnection.HTTP_OK == ((java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection()).getResponseCode() ? 0 : 1); } }" > /tmp/HealthCheck.java && java /tmp/HealthCheck.java http://localhost:9000/health/live',
        ]
      interval: 5s
      timeout: 5s
      retries: 30
    command:
      - start-dev
      - --http-enabled=true
      - --proxy-headers=xforwarded

  keycloak-database:
    image: postgres:17
    container_name: keycloak-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ./postgres/data:/var/lib/postgresql/data # save data in a volume
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
  nginx:
    image: nginx:1.23.1-alpine
    container_name: nginx
    environment:
      KEYCLOAK_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      KEYCLOAK_PORT: ${KEYCLOAK_PORT}
    ports:
      - 80:80
    volumes:
      - ./nginx/keycloak.conf:/etc/nginx/templates/default.conf.template
    depends_on:
      - keycloak

  keycloak-config-cli:
    image: adorsys/keycloak-config-cli:6.5.0-26
    depends_on:
      keycloak:
        condition: service_healthy
    environment:
      KEYCLOAK_URL: "http://keycloak:8080"
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      IMPORT_FILES_LOCATIONS: "/config/*.yaml"
      IMPORT_VAR_SUBSTITUTION_ENABLED: "true"
      IMPORT_STATE: "true" # Enable remote state management
      IMPORT_VALIDATE: "true" # Enable remote state management
    volumes:
      - ./config:/config
    env_file:
      - .env