services:
  keycloak_web:
    ##image: quay.io/keycloak/keycloak:26.3
    image: {{ docker_registry }}/custom-keycloak-web:{{ instance_type }}
    container_name: keycloak_web
    restart: always
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloakdb:5432/keycloak
      KC_DB_USERNAME: {{ iam_db_username }}
      KC_DB_PASSWORD: {{ iam_db_pass }}

      KC_HOSTNAME: {{ iam_fqdn }}
      KC_HOSTNAME_PORT: 8443
      KEYCLOAK_HTTPS_PORT: 8443
      KEYCLOAK_PRODUCTION: 'true'
      KEYCLOAK_ENABLE_HTTPS: 'true'
      KEYCLOAK_HTTPS_USE_PEM: 'true'
      KC_HTTPS_CERTIFICATE_FILE: /etc/x509/https/iam.pem
      KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/x509/https/iam.pem
      KC_LOG_LEVEL: info
      KC_METRICS_ENABLED: 'true'
      KC_HEALTH_ENABLED: 'true'
      KEYCLOAK_ADMIN: {{ iam_admin_username }}
      KEYCLOAK_ADMIN_PASSWORD: {{ iam_admin_pass }}
      KC_SPI_TRUSTSTORE_FILE_PASSWORD: password 
      KC_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY: ANY
{% if user_event_publisher.enable == "yes" %}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_KEYCLOAK_ORIGIN: https://{{ iam_fqdn }}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_USER_ORIGIN: {{ user_event_publisher.user_app_url }}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_REALM: {{ iam_realm }}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_CLIENT_ID: {{ user_app_client_id }}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_CLIENT_SECRET: {{ user_app_client_secret }}
      KC_SPI_EVENTS_LISTENER_USER_EVENTS_PUBLISHER_TIMEOUT: 5
{% endif %}
    command: 
      - start
    depends_on:
      - keycloakdb
    ports:
      - 443:8443
    volumes:
      - "/opt/docker/keycloak/ssl/:/etc/x509/https"

  keycloakdb:
    image: postgres:16
    container_name: keycloakdb
    restart: always
    volumes:
      - /opt/docker/keycloak/db/:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: {{ iam_db_username }}
      POSTGRES_PASSWORD: {{ iam_db_pass }}