commit b309840e80c5b6f630703c832fbc6edb4d043cbf
Author: nkozobrod <nkozobrod@kzbrd.ru>
Date:   Mon Jul 20 19:10:11 2026 +0300

    Initial commit: Keycloak 26.7 setup for kk.kzbrd.ru

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..775cf55
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+.env
+data/
+*.log
+.DS_Store
+Thumbs.db
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..1ac8b38
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,62 @@
+name: keycloak
+
+services:
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.7.0
+    restart: always
+    depends_on:
+      kc-db:
+        condition: service_healthy
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://kc-db:5432/keycloak
+      KC_DB_USERNAME: keycloak
+      KC_DB_PASSWORD: ${KC_DB_PASSWORD}
+      KC_BOOTSTRAP_ADMIN_USERNAME: admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD}
+      KC_HOSTNAME: kk.kzbrd.ru
+      KC_PROXY_HEADERS: xforwarded
+      KC_HTTP_ENABLED: "true"
+      KC_HEALTH_ENABLED: "true"
+    command: start
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik_proxy"
+      - "traefik.http.routers.keycloak.rule=Host(`kk.kzbrd.ru`)"
+      - "traefik.http.routers.keycloak.entrypoints=websecure"
+      - "traefik.http.routers.keycloak.tls=true"
+      - "traefik.http.routers.keycloak.tls.certresolver=myresolver"
+      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
+      - "com.centurylinklabs.watchtower.enable=true"
+    networks:
+      - traefik_proxy
+      - default
+
+  kc-db:
+    image: docker.io/postgres:17
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U keycloak"]
+      interval: 3s
+      timeout: 3s
+      retries: 10
+    environment:
+      POSTGRES_USER: keycloak
+      POSTGRES_PASSWORD: ${KC_DB_PASSWORD}
+      POSTGRES_DB: keycloak
+      TZ: UTC
+      PGTZ: UTC
+    volumes:
+      - kc_postgres_data:/var/lib/postgresql/data
+    networks:
+      - default
+
+volumes:
+  kc_postgres_data:
+    driver: local
+
+networks:
+  traefik_proxy:
+    external: true
+  default:
+    driver: bridge