eaa163afa4
Update Keycloak probe/realm import behavior and authority config so auth services start reliably on the dev cluster, while keeping CD deployment steps aligned with the actual Kubernetes overlay behavior.
59 lines
1.7 KiB
YAML
59 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: workclub-config
|
|
labels:
|
|
app: workclub
|
|
data:
|
|
log-level: "Information"
|
|
cors-origins: "http://localhost:3000"
|
|
api-base-url: "http://workclub-api"
|
|
keycloak-url: "http://workclub-keycloak"
|
|
keycloak-authority: "http://workclub-keycloak/realms/workclub"
|
|
keycloak-audience: "workclub-api"
|
|
keycloak-realm: "workclub"
|
|
|
|
# Database configuration
|
|
database-host: "workclub-postgres"
|
|
database-port: "5432"
|
|
database-name: "workclub"
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: postgres-init
|
|
labels:
|
|
app: workclub-postgres
|
|
data:
|
|
init.sql: |
|
|
-- Create keycloak database and user
|
|
CREATE DATABASE keycloak;
|
|
CREATE USER keycloak WITH PASSWORD 'keycloakpass';
|
|
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
|
|
|
|
-- Keycloak database permissions
|
|
\c keycloak
|
|
GRANT ALL PRIVILEGES ON SCHEMA public TO keycloak;
|
|
ALTER SCHEMA public OWNER TO keycloak;
|
|
|
|
-- Application database permissions
|
|
\c workclub
|
|
GRANT ALL PRIVILEGES ON SCHEMA public TO app;
|
|
ALTER SCHEMA public OWNER TO app;
|
|
|
|
-- App admin role for RLS bypass policies used by API startup seed
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_admin') THEN
|
|
CREATE ROLE app_admin;
|
|
END IF;
|
|
END
|
|
$$;
|
|
GRANT app_admin TO app WITH INHERIT FALSE, SET TRUE;
|
|
GRANT USAGE ON SCHEMA public TO app_admin;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO app_admin;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO app_admin;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON TABLES TO app_admin;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON SEQUENCES TO app_admin;
|