services:
  keycloak_web:
    # image: quay.io/keycloak/keycloak:25.0.1
    image: quay.io/keycloak/keycloak:latest
    container_name: keycloak_web
    restart: always
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloakdb:5432/keycloak
      KC_DB_USERNAME: {{ iam_db_username }}
      KC_DB_PASSWORD: {{ iam_db_pass }}

      KC_HOSTNAME: {{ iam_fqdn }}
      KC_HOSTNAME_PORT: 8443
      KEYCLOAK_HTTPS_PORT: 8443
      KEYCLOAK_PRODUCTION: 'true'
      KEYCLOAK_ENABLE_HTTPS: 'true'
      KEYCLOAK_HTTPS_USE_PEM: 'true'
      KC_HTTPS_CERTIFICATE_FILE: /etc/x509/https/iam.pem
      KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/x509/https/iam.pem
      KC_LOG_LEVEL: info
      KC_METRICS_ENABLED: 'true'
      KC_HEALTH_ENABLED: 'true'
      KEYCLOAK_ADMIN: {{ iam_admin_username }}
      KEYCLOAK_ADMIN_PASSWORD: {{ iam_admin_pass }}
    command: 
      - start
    depends_on:
      - keycloakdb
    ports:
      - 443:8443
    volumes:
      - "/opt/docker/keycloak/ssl/:/etc/x509/https"

  keycloakdb:
    image: postgres:16
    container_name: keycloakdb
    restart: always
    volumes:
      - /opt/docker/keycloak/db/:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: {{ iam_db_username }}
      POSTGRES_PASSWORD: {{ iam_db_pass }}