name: keycloak

services:
  keycloak:
    image: quay.io/keycloak/keycloak:26.7.0
    restart: always
    depends_on:
      kc-db:
        condition: service_healthy
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://kc-db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${KC_DB_PASSWORD}
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD}
      KC_HOSTNAME: kk.kzbrd.ru
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
    command: start
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.http.routers.keycloak.rule=Host(`kk.kzbrd.ru`)"
      - "traefik.http.routers.keycloak.entrypoints=websecure"
      - "traefik.http.routers.keycloak.tls=true"
      - "traefik.http.routers.keycloak.tls.certresolver=myresolver"
      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
      - "com.centurylinklabs.watchtower.enable=true"
    networks:
      - traefik_proxy
      - default

  kc-db:
    image: docker.io/postgres:17
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 3s
      timeout: 3s
      retries: 10
    environment:
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD}
      POSTGRES_DB: keycloak
      TZ: UTC
      PGTZ: UTC
    volumes:
      - kc_postgres_data:/var/lib/postgresql/data
    networks:
      - default

volumes:
  kc_postgres_data:
    driver: local

networks:
  traefik_proxy:
    external: true
  default:
    driver: bridge