networks:
  keycloak-net:
    name: keycloak-net
    driver: bridge
    ipam:
      driver: default
      config:
        - gateway: ${SUBNET_PREFIX:?SUBNET_PREFIX required}.1
          subnet: ${SUBNET_PREFIX}.0/24
    driver_opts:
      com.docker.network.bridge.name: keycloak-net

services:
  postgres:
    container_name: keycloak-postgres
    restart: always
    image: postgres:15.2
    volumes:
      - ${KEYCLOAK_DIR}/data/postgres:/var/lib/postgresql/data
      - /etc/localtime:/etc/localtime:ro
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-d", "keycloak", "-U", "keycloak"]
      interval: 30s
      timeout: 20s
      retries: 3
    environment:
      - POSTGRES_USER=keycloak
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?postgres password required}
      - POSTGRES_DB=keycloak
    networks:
      keycloak-net:
        ipv4_address: ${SUBNET_PREFIX}.2
    cap_drop:
      - net_raw
    command: [postgres, -c, max_connections=200]      

  keycloak:
    image: quay.io/keycloak/keycloak
    container_name: keycloak
    restart: always
    volumes:
      - /etc/localtime:/etc/localtime:ro
    environment:
      KC_HOSTNAME: 'http://192.168.182.52:8080'
      KC_HTTP_PORT: 8080
      #KC_FEATURES: token-exchange
      KC_DB: postgres
      KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak"
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD:?postgres password required}
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: password
      KC_HEALTH_ENABLED: true
      KC_DB_SCHEMA: public
      KC_LOG_LEVEL: info
      #KC_PROXY: edge
      KC_HOSTNAME_ADMIN: 'http://192.168.182.52:8080'
      #KC_HOSTNAME_BACKCHANNEL_DYNAMIC: true
      #KC_PROXY_ADDRESS_FORWARDING: true
      #KC_HOSTNAME_STRICT: true
      KC_HTTP_ENABLED: true
      #KC_PROXY_HEADERS: xforwarded
      #KC_SPI_LOGIN_PROTOCOL_OPENID_CONNECT_LEGACY_LOGOUT_REDIRECT_URI: true
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/health/ready" ]
      interval: 15s
      timeout: 2s
      retries: 15
    command: start
    ports:
      - 8080:8080
    depends_on:
      - postgres
    networks:
      keycloak-net:
        ipv4_address: ${SUBNET_PREFIX}.3
    cap_drop:
      - net_raw      
