infra(docker): add Docker Compose with PostgreSQL and Keycloak
- Add docker-compose.yml (v3.9) with postgres:16-alpine and keycloak:26.1 services - Configure PostgreSQL with separate workclub and keycloak databases - Setup Keycloak with database backend, admin user, and realm import capability - Create PostgreSQL init script to provision development databases and users - Add placeholder realm-export.json for Keycloak realm configuration - Configure healthchecks and app-network bridge for service discovery - Document configuration and patterns in learnings.md
This commit is contained in:
OpenCode Assistant
320
infra/keycloak/realm-export.json
Normal file
320
infra/keycloak/realm-export.json
Normal file
@@ -0,0 +1,320 @@
|
||||
{
|
||||
"realm": "workclub",
|
||||
"enabled": true,
|
||||
"displayName": "WorkClub Development Realm",
|
||||
"displayNameHtml": "<div class=\"kc-logo-text\"><span>WorkClub</span></div>",
|
||||
"accessTokenLifespan": 3600,
|
||||
"accessTokenLifespanForImplicitFlow": 900,
|
||||
"ssoSessionIdleTimeout": 1800,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
"offlineSessionIdleTimeout": 2592000,
|
||||
"accessCodeLifespan": 60,
|
||||
"accessCodeLifespanUserAction": 300,
|
||||
"sslRequired": "external",
|
||||
"registrationAllowed": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"resetPasswordAllowed": true,
|
||||
"editUsernameAllowed": false,
|
||||
"bruteForceProtected": true,
|
||||
"permanentLockout": false,
|
||||
"maxFailureWaitSeconds": 900,
|
||||
"failureFactor": 10,
|
||||
"defaultSignatureAlgorithm": "RS256",
|
||||
"revokeRefreshToken": false,
|
||||
"refreshTokenMaxReuse": 0,
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "workclub-api",
|
||||
"name": "WorkClub Backend API",
|
||||
"description": "Confidential client for backend service-to-service authentication",
|
||||
"enabled": true,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "dev-secret-workclub-api-change-in-production",
|
||||
"publicClient": false,
|
||||
"standardFlowEnabled": false,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": true,
|
||||
"authorizationServicesEnabled": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"access.token.lifespan": "3600"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "club-membership",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "clubs",
|
||||
"claim.name": "clubs",
|
||||
"jsonType.label": "JSON",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"userinfo.token.claim": "true",
|
||||
"multivalued": "false",
|
||||
"aggregate.attrs": "false"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"acr",
|
||||
"profile",
|
||||
"roles",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"clientId": "workclub-app",
|
||||
"name": "WorkClub Frontend",
|
||||
"description": "Public client for frontend SPA with PKCE",
|
||||
"enabled": true,
|
||||
"publicClient": true,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"authorizationServicesEnabled": false,
|
||||
"protocol": "openid-connect",
|
||||
"redirectUris": [
|
||||
"http://localhost:3000/*"
|
||||
],
|
||||
"webOrigins": [
|
||||
"http://localhost:3000"
|
||||
],
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256",
|
||||
"post.logout.redirect.uris": "http://localhost:3000/*",
|
||||
"access.token.lifespan": "3600"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "club-membership",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "clubs",
|
||||
"claim.name": "clubs",
|
||||
"jsonType.label": "JSON",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"userinfo.token.claim": "true",
|
||||
"multivalued": "false",
|
||||
"aggregate.attrs": "false"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"acr",
|
||||
"profile",
|
||||
"roles",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
]
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"username": "admin@test.com",
|
||||
"email": "admin@test.com",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"firstName": "Admin",
|
||||
"lastName": "User",
|
||||
"attributes": {
|
||||
"clubs": ["{\"club-1-uuid\": \"admin\", \"club-2-uuid\": \"member\"}"]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"hashedSaltedValue": "oZz2L6ynBvAQJ9dqF5dZ3q5J5L5yJ5J5J5J5J5J5J5I=",
|
||||
"salt": "KqJ5J5J5J5J5J5J5J5J5Jw==",
|
||||
"hashIterations": 210000,
|
||||
"algorithm": "pbkdf2-sha512",
|
||||
"createdDate": 1709478000000,
|
||||
"temporary": false
|
||||
}
|
||||
],
|
||||
"requiredActions": []
|
||||
},
|
||||
{
|
||||
"username": "manager@test.com",
|
||||
"email": "manager@test.com",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"firstName": "Manager",
|
||||
"lastName": "User",
|
||||
"attributes": {
|
||||
"clubs": ["{\"club-1-uuid\": \"manager\"}"]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"hashedSaltedValue": "oZz2L6ynBvAQJ9dqF5dZ3q5J5L5yJ5J5J5J5J5J5J5I=",
|
||||
"salt": "KqJ5J5J5J5J5J5J5J5J5Jw==",
|
||||
"hashIterations": 210000,
|
||||
"algorithm": "pbkdf2-sha512",
|
||||
"createdDate": 1709478000000,
|
||||
"temporary": false
|
||||
}
|
||||
],
|
||||
"requiredActions": []
|
||||
},
|
||||
{
|
||||
"username": "member1@test.com",
|
||||
"email": "member1@test.com",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"firstName": "Member",
|
||||
"lastName": "One",
|
||||
"attributes": {
|
||||
"clubs": ["{\"club-1-uuid\": \"member\", \"club-2-uuid\": \"member\"}"]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"hashedSaltedValue": "oZz2L6ynBvAQJ9dqF5dZ3q5J5L5yJ5J5J5J5J5J5J5I=",
|
||||
"salt": "KqJ5J5J5J5J5J5J5J5J5Jw==",
|
||||
"hashIterations": 210000,
|
||||
"algorithm": "pbkdf2-sha512",
|
||||
"createdDate": 1709478000000,
|
||||
"temporary": false
|
||||
}
|
||||
],
|
||||
"requiredActions": []
|
||||
},
|
||||
{
|
||||
"username": "member2@test.com",
|
||||
"email": "member2@test.com",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"firstName": "Member",
|
||||
"lastName": "Two",
|
||||
"attributes": {
|
||||
"clubs": ["{\"club-1-uuid\": \"member\"}"]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"hashedSaltedValue": "oZz2L6ynBvAQJ9dqF5dZ3q5J5L5yJ5J5J5J5J5J5J5I=",
|
||||
"salt": "KqJ5J5J5J5J5J5J5J5J5Jw==",
|
||||
"hashIterations": 210000,
|
||||
"algorithm": "pbkdf2-sha512",
|
||||
"createdDate": 1709478000000,
|
||||
"temporary": false
|
||||
}
|
||||
],
|
||||
"requiredActions": []
|
||||
},
|
||||
{
|
||||
"username": "viewer@test.com",
|
||||
"email": "viewer@test.com",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"firstName": "Viewer",
|
||||
"lastName": "User",
|
||||
"attributes": {
|
||||
"clubs": ["{\"club-1-uuid\": \"viewer\"}"]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"hashedSaltedValue": "oZz2L6ynBvAQJ9dqF5dZ3q5J5L5yJ5J5J5J5J5J5J5I=",
|
||||
"salt": "KqJ5J5J5J5J5J5J5J5J5Jw==",
|
||||
"hashIterations": 210000,
|
||||
"algorithm": "pbkdf2-sha512",
|
||||
"createdDate": 1709478000000,
|
||||
"temporary": false
|
||||
}
|
||||
],
|
||||
"requiredActions": []
|
||||
}
|
||||
],
|
||||
"roles": {
|
||||
"realm": [],
|
||||
"client": {}
|
||||
},
|
||||
"groups": [],
|
||||
"defaultRole": {
|
||||
"name": "default-roles-workclub",
|
||||
"description": "${role_default-roles}",
|
||||
"composite": true,
|
||||
"clientRole": false,
|
||||
"containerId": "workclub"
|
||||
},
|
||||
"requiredCredentials": [
|
||||
"password"
|
||||
],
|
||||
"otpPolicyType": "totp",
|
||||
"otpPolicyAlgorithm": "HmacSHA1",
|
||||
"otpPolicyInitialCounter": 0,
|
||||
"otpPolicyDigits": 6,
|
||||
"otpPolicyLookAheadWindow": 1,
|
||||
"otpPolicyPeriod": 30,
|
||||
"otpSupportedApplications": [
|
||||
"totpAppGoogleName",
|
||||
"totpAppMicrosoftAuthenticatorName"
|
||||
],
|
||||
"webAuthnPolicyRpEntityName": "keycloak",
|
||||
"webAuthnPolicySignatureAlgorithms": [
|
||||
"ES256"
|
||||
],
|
||||
"webAuthnPolicyRpId": "",
|
||||
"webAuthnPolicyAttestationConveyancePreference": "not specified",
|
||||
"webAuthnPolicyAuthenticatorAttachment": "not specified",
|
||||
"webAuthnPolicyRequireResidentKey": "not specified",
|
||||
"webAuthnPolicyUserVerificationRequirement": "not specified",
|
||||
"webAuthnPolicyCreateTimeout": 0,
|
||||
"webAuthnPolicyAvoidSameAuthenticatorRegister": false,
|
||||
"webAuthnPolicyAcceptableAaguids": [],
|
||||
"browserSecurityHeaders": {
|
||||
"contentSecurityPolicyReportOnly": "",
|
||||
"xContentTypeOptions": "nosniff",
|
||||
"referrerPolicy": "no-referrer",
|
||||
"xRobotsTag": "none",
|
||||
"xFrameOptions": "SAMEORIGIN",
|
||||
"contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
|
||||
"xXSSProtection": "1; mode=block",
|
||||
"strictTransportSecurity": "max-age=31536000; includeSubDomains"
|
||||
},
|
||||
"smtpServer": {},
|
||||
"eventsEnabled": false,
|
||||
"eventsListeners": [
|
||||
"jboss-logging"
|
||||
],
|
||||
"enabledEventTypes": [],
|
||||
"adminEventsEnabled": false,
|
||||
"adminEventsDetailsEnabled": false,
|
||||
"identityProviders": [],
|
||||
"identityProviderMappers": [],
|
||||
"components": {},
|
||||
"internationalizationEnabled": false,
|
||||
"supportedLocales": [],
|
||||
"authenticationFlows": [],
|
||||
"authenticatorConfig": [],
|
||||
"requiredActions": [],
|
||||
"browserFlow": "browser",
|
||||
"registrationFlow": "registration",
|
||||
"directGrantFlow": "direct grant",
|
||||
"resetCredentialsFlow": "reset credentials",
|
||||
"clientAuthenticationFlow": "clients",
|
||||
"dockerAuthenticationFlow": "docker auth",
|
||||
"attributes": {},
|
||||
"keycloakVersion": "26.0.0"
|
||||
}
|
||||
23
infra/postgres/init.sql
Normal file
23
infra/postgres/init.sql
Normal file
@@ -0,0 +1,23 @@
|
||||
#!/bin/bash
|
||||
# PostgreSQL initialization script for development environment
|
||||
# Creates: workclub (application data), keycloak (Keycloak metadata)
|
||||
|
||||
set -e
|
||||
|
||||
# Create application database
|
||||
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
|
||||
CREATE USER app WITH PASSWORD 'devpass';
|
||||
CREATE DATABASE workclub OWNER app;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
|
||||
EOSQL
|
||||
|
||||
# Create Keycloak database
|
||||
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
|
||||
CREATE USER keycloak WITH PASSWORD 'keycloakpass';
|
||||
CREATE DATABASE keycloak OWNER keycloak;
|
||||
ALTER DEFAULT PRIVILEGES IN DATABASE keycloak GRANT ALL ON TABLES TO keycloak;
|
||||
ALTER DEFAULT PRIVILEGES IN DATABASE keycloak GRANT ALL ON SEQUENCES TO keycloak;
|
||||
EOSQL
|
||||
|
||||
echo "PostgreSQL initialization complete: workclub and keycloak databases created"
|
||||
Reference in New Issue
Block a user