Skip to content

Commit d0bfcd3

Browse files
nmorenornmorenor
authored
Add keycloak docker compose (#148)
1 parent db4a91d commit d0bfcd3

7 files changed

Lines changed: 203 additions & 11 deletions

File tree

‎compose/.gitignore‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
data/
2+
nginx/log/
3+
nginx/ssl/*.key
4+
nginx/ssl/*.pem
5+
nginx/ssl/*.crt
6+
keycloak/nginx/log/*.log
7+
keycloak/nginx/ssl/*.key
8+
keycloak/nginx/ssl/*.pem
9+
keycloak/nginx/ssl/*.crt
10+
.env

‎compose/cthq.properties‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,40 @@ hq.collab.secret=${INTEL_SECRET}
66
# Fill in values specific to your deployment
77

88
# If you want to run with multiple SSO providers, add their names separated with commas
9-
hq.sso.tenants=github
9+
# hq.sso.tenants=github
1010

1111
# GitHub SSO
12-
hq.sso.github.provider=github
13-
hq.sso.github.label=GitHub
14-
hq.sso.github.client.id=<github_client_id>
15-
hq.sso.github.client.secret=<github_client_secret>
16-
hq.sso.github.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
17-
hq.sso.github.auth.uri=https://github.com/login/oauth/authorize
18-
hq.sso.github.token.uri=https://github.com/login/oauth/access_token
19-
hq.sso.github.info.uri=https://api.github.com/user
20-
hq.sso.github.jwt.set.uri=https://token.actions.githubusercontent.com/.well-known/jwks
21-
hq.sso.github.logout.uri=https://github.com/logout
12+
# hq.sso.github.provider=github
13+
# hq.sso.github.label=GitHub
14+
# hq.sso.github.client.id=Iv1.45b9336a78ce2476
15+
# hq.sso.github.client.secret=c4446ad126ec65b3d926e37de3fe880246aff371
16+
# hq.sso.github.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
17+
# hq.sso.github.auth.uri=https://github.com/login/oauth/authorize
18+
# hq.sso.github.token.uri=https://github.com/login/oauth/access_token
19+
# hq.sso.github.info.uri=https://api.github.com/user
20+
# hq.sso.github.jwt.set.uri=https://token.actions.githubusercontent.com/.well-known/jwks
21+
# hq.sso.github.logout.uri=https://github.com/logout
22+
23+
hq.sso.provider=keycloak
24+
hq.sso.client.id=codetogether
25+
hq.sso.client.secret=eFl6XSKwMMsEW1yRTY9pHjBrCTHDEY64
26+
hq.sso.client.issuer.url=http://codetogether-keycloak:8080/realms/codetogether
27+
hq.sso.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
28+
hq.sso.client.authentication.method=client_secret_post
29+
30+
# hq.sso.provider=keycloak
31+
# hq.sso.client.id=YOUR_CLIENT_ID
32+
# hq.sso.client.secret=YOUR_CLIENT_SECRET
33+
# hq.sso.client.issuer.url=http://codetogether-keycloak:8080/realms/codetogether
34+
# hq.sso.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
35+
# hq.sso.client.authentication.method=client_secret_post
36+
37+
# hq.sso.provider=keycloak
38+
# hq.sso.client.id=YOUR_CLIENT_ID
39+
# hq.sso.client.secret=YOUR_CLIENT_SECRET
40+
# hq.sso.client.issuer.url=http://codetogether-keycloak:8080/realms/codetogether
41+
# hq.sso.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
42+
# hq.sso.client.authentication.method=client_secret_post
2243

2344
# These values do not need to be changed, though secrets can be updated
2445
hq.db.type=CASSANDRA

‎compose/keycloak/.env-template‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
KEYCLOAK_FQDN=keycloak.example.com
2+
SSL_KEYCLOAK_CERT=ssl-keycloak.crt
3+
SSL_KEYCLOAK_KEY=ssl-keycloak.key
4+
5+
KEYCLOAK_DB_USERNAME=keycloak
6+
KEYCLOAK_DB_PASSWORD=keycloak
7+
8+
KEYCLOAK_ADMIN_PASSWORD=keycloak
9+
KEYCLOAK_ADMIN=admin

‎compose/keycloak/compose.keycloak.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# 👇 Rename `.env-template` to `.env` before running this file
2+
# Set the appropriate values once renamed
3+
services:
4+
# Relational database for Keycloak (optional)
5+
codetogether-mysql:
6+
image: mysql:8.0
7+
container_name: codetogether-mysql
8+
restart: unless-stopped
9+
env_file:
10+
- .env
11+
environment:
12+
MYSQL_ROOT_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
13+
MYSQL_DATABASE: keycloak
14+
MYSQL_USER: ${KEYCLOAK_DB_USERNAME}
15+
MYSQL_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
16+
volumes:
17+
- mysql_data:/var/lib/mysql
18+
networks:
19+
- codetogethernet
20+
healthcheck:
21+
test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
22+
interval: 10s
23+
timeout: 10s
24+
retries: 30
25+
# Nginx reverse proxy for Keycloak (optional)
26+
codetogether-keycloak-nginx:
27+
image: nginx:latest
28+
container_name: codetogether-keycloak-nginx
29+
env_file:
30+
- .env
31+
environment:
32+
- NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx
33+
ports:
34+
- "443:443"
35+
volumes:
36+
- ./nginx/nginx.conf.template:/etc/nginx/templates/nginx.conf.template:ro
37+
- ./nginx/ssl:/etc/nginx/ssl
38+
- ./nginx/log:/var/log/nginx
39+
networks:
40+
- codetogethernet
41+
depends_on:
42+
codetogether-keycloak:
43+
condition: service_healthy
44+
45+
# Keycloak service (optional)
46+
codetogether-keycloak:
47+
image: quay.io/keycloak/keycloak:latest
48+
container_name: codetogether-keycloak
49+
env_file:
50+
- .env
51+
depends_on:
52+
codetogether-mysql:
53+
condition: service_healthy
54+
command:
55+
- "start"
56+
environment:
57+
# Admin credentials
58+
KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
59+
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
60+
61+
# Database connectivity
62+
KC_DB: mysql
63+
KC_DB_USERNAME: ${KEYCLOAK_DB_USERNAME:-root}
64+
KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
65+
KC_DB_URL_HOST: codetogether-mysql
66+
67+
# Feature flags & observability
68+
KC_FEATURES: token-exchange
69+
KC_HEALTH_ENABLED: "true"
70+
KC_METRICS_ENABLED: "true"
71+
72+
# Reverse‑proxy / HTTP
73+
KC_HTTP_ENABLED: "true"
74+
KC_PROXY: edge
75+
KC_PROXY_HEADERS: xforwarded
76+
KC_HOSTNAME_STRICT: "false"
77+
KC_HOSTNAME_STRICT_HTTPS: "false"
78+
KC_HOSTNAME: ${KEYCLOAK_FQDN}
79+
KC_FRONTEND_URL: https://${KEYCLOAK_FQDN}
80+
KC_HTTP_PORT: 8080
81+
networks:
82+
- codetogethernet
83+
healthcheck:
84+
test: ["CMD-SHELL", "echo > /dev/tcp/localhost/8080 || exit 1"]
85+
interval: 10s
86+
timeout: 5s
87+
retries: 5
88+
start_period: 30s
89+
90+
volumes:
91+
mysql_data:
92+
93+
networks:
94+
codetogethernet:
95+
driver: bridge

‎compose/keycloak/nginx/log/placeholder.txt‎

Whitespace-only changes.

‎compose/keycloak/nginx/nginx.conf.template‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
events {
2+
worker_connections 1024;
3+
}
4+
5+
http {
6+
include mime.types;
7+
default_type application/octet-stream;
8+
sendfile on;
9+
keepalive_timeout 65;
10+
server {
11+
server_name ${KEYCLOAK_FQDN};
12+
listen 443 ssl http2;
13+
14+
# configure proxy buffer sizes
15+
proxy_buffer_size 128k;
16+
proxy_buffers 4 256k;
17+
18+
# setup the SSL certificate
19+
ssl_certificate /etc/nginx/ssl/${SSL_KEYCLOAK_CERT};
20+
ssl_certificate_key /etc/nginx/ssl/${SSL_KEYCLOAK_KEY};
21+
# ssl_dhparam /etc/nginx/ssl/${DHPARAM_PEM};
22+
ssl_prefer_server_ciphers on;
23+
ssl_protocols TLSv1.2;
24+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
25+
26+
# create the passthrough to the CodeTogether Intel container
27+
location / {
28+
29+
# set passthru parameters for the CodeTogether Intel container
30+
set $realIP $remote_addr;
31+
set $forwardTo $proxy_add_x_forwarded_for;
32+
set $reqHost $http_host;
33+
client_max_body_size 32M;
34+
if ($http_x_real_ip != '') {
35+
set $realIP $http_x_real_ip;
36+
}
37+
if ($http_x_forwarded_for != '') {
38+
set $forwardTo $http_x_forwarded_for;
39+
}
40+
proxy_set_header X-Real-IP $realIP;
41+
proxy_set_header X-Forwarded-For $forwardTo;
42+
proxy_set_header Host $reqHost;
43+
proxy_set_header X-Forwarded-Proto https;
44+
45+
# setup the backend to service the HQ requests
46+
proxy_pass http://codetogether-keycloak:8080;
47+
proxy_set_header X-NginX-Proxy true;
48+
proxy_http_version 1.1;
49+
proxy_redirect off;
50+
proxy_set_header Upgrade $http_upgrade;
51+
proxy_set_header Connection "upgrade";
52+
proxy_read_timeout 360;
53+
proxy_connect_timeout 360;
54+
proxy_send_timeout 360;
55+
}
56+
}
57+
}

‎compose/keycloak/nginx/ssl/placeholder.txt‎

Whitespace-only changes.

0 commit comments

Comments
 (0)