1extends "../../config/Service.pkl"
2
3import "../../config/Service.pkl" as service
4import "../../config/site.pkl" as site
5import "../postgres/service.pkl" as postgres
6
7class OpenIDClient extends service.Requirement {
8 alias: String = "oidc"
9 fixed provider = "keycloak"
10 fixed kind = "client"
11 clientId: String(isNotEmpty)
12 name: String
13 redirectUris: Listing<String> = new { "*" }
14 usernameAliases: Mapping<String, String> = new {}
15}
16
17local database = new postgres.Database { name = "keycloak_next" }
18
19meta { name = "Keycloak"; launcher = false }
20traceServiceName = module.id
21dependsOn { "victoria" }
22healthyDeadline = "20m"
23setup = "configure.py"
24provide = "provide.py"
25
26requirements { database }
27
28container {
29 image = "quay.io/keycloak/keycloak@sha256:82a77884f3af238beab1e7afd63b5f530e1b5c0590bd7aa60b40a40463e29b2c"
30 rootGroup = true
31 cpu = 500
32 memory = 1200
33 args { "start" }
34
35 http {
36 containerPort = 8080
37 subdomain = "auth"
38 plainHostnames { "keycloak.\(site.domain)" }
39 checkPath = "/realms/master"
40 }
41
42 volumes {
43 ["/opt/keycloak/data"] {}
44 ["/opt/keycloak/themes/snow"] { config = "theme" }
45 }
46
47 env {
48 ["JAVA_TOOL_OPTIONS"] = read?("env:STUDIO_JAVA_OPTIONS") ?? ""
49 ["KC_DB"] = "postgres"
50 ["KC_DB_USERNAME"] = "${secret.database.username}"
51 ["KC_DB_PASSWORD"] = "${secret.database.password}"
52 ["KC_BOOTSTRAP_ADMIN_USERNAME"] = "admin"
53 ["KC_BOOTSTRAP_ADMIN_PASSWORD"] = "${secret.own.password}"
54 ["KC_HTTP_ENABLED"] = "true"
55 ["KC_PROXY_HEADERS"] = "xforwarded"
56 ["KC_HOSTNAME"] = "https://\(module.container.http.hostname)"
57 ["KC_TRACING_ENABLED"] = "true"
58 ["KC_TRACING_PROTOCOL"] = "http/protobuf"
59 ["KC_TELEMETRY_SERVICE_NAME"] = module.id
60 ["KC_TRACING_SAMPLER_TYPE"] = "parentbased_traceidratio"
61 ["KC_TRACING_SAMPLER_RATIO"] = "0.25"
62 }
63
64 envTemplate = """
65 {{ range nomadService 1 (env "NOMAD_ALLOC_ID") "\(database.provider)" }}KC_DB_URL=jdbc:postgresql://\(module.nomadHostPort)/{{ with nomadVar "nomad/jobs/\(module.id)/inputs/database" }}{{ .name }}{{ end }}{{ end }}
66 {{ range nomadService 1 (env "NOMAD_ALLOC_ID") "victoria-traces" }}KC_TRACING_ENDPOINT=http://\(module.nomadHostPort)/insert/opentelemetry{{ end }}
67 """
68}
69
70secrets {
71 ["password"] {}
72 ["snow_password"] {}
73}