docker-compose.yaml

services:
  keycloak-service:
    image: quay.io/keycloak/keycloak:26.1.3
    container_name: keycloak-container
    command: >-
      start
      --features=preview
    environment:
      # Database configuration
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-postgres:5432/keycloak_db
      KC_DB_USERNAME: keycloak_user
      KC_DB_PASSWORD: secure_password_123  # Replace with a strong password
      KC_DB_POOL_INITIAL_SIZE: 10
      KC_DB_POOL_MAX_SIZE: 100
      KC_DB_POOL_MIN_SIZE: 10
      KC_DB_SCHEMA: keycloak
      # Admin credentials
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin_secure_password  # Replace with a strong password
      # Hostname settings for production
      KC_HOSTNAME: https://localhost  # Replace with your domain (e.g., keycloak.example.com)
      KC_HOSTNAME_STRICT: "true"
      KC_HOSTNAME_STRICT_HTTPS: "true"  # Enforce HTTPS
      KC_HTTP_ENABLED: "true"  # Allow HTTP (Nginx will handle HTTPS)
      KC_PROXY: edge  # Use 'edge' since Nginx terminates TLS
      PROXY_ADDRESS_FORWARDING: "true"
      # Performance and logging
      KC_LOG_LEVEL: info
      KC_LOG_CONSOLE_COLOR: "true"
      KC_METRICS_ENABLED: "true"
      KC_HTTP_METRICS_SLOS: "5,10,25,50,250,500,1000,2500,5000,10000"
      KC_HTTP_METRICS_HISTOGRAMS_ENABLED: "true"
      KC_EVENT_METRICS_USER_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      # Enable OpenTelemetry
#      KC_TRACING_ENABLED: "true"
#      KC_TRACING_COMPRESSION: "gzip"
#      KC_TRACING_JDBC_ENABLED: "true"
#      KC_TRACING_SAMPLER_RATIO: 1.0

      # JVM options for production (adjust based on your needs)
      JAVA_OPTS: "-Xms512m -Xmx2048m -XX:+UseG1GC"
    depends_on:
      keycloak_postgres:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - keycloak-network

  keycloak-postgres:
    image: postgres:17-alpine
    container_name: keycloak-postgres
    environment:
      POSTGRES_DB: keycloak_db
      POSTGRES_USER: keycloak_user
      POSTGRES_PASSWORD: secure_password_123  # Match this with KC_DB_PASSWORD
      POSTGRES_SCHEMA: keycloak
    volumes:
      - keycloak-postgres-data:/var/lib/postgresql/data
      - ./postgres/init-schema.sh:/docker-entrypoint-initdb.d/init-schema.sh
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak_user -d keycloak_db"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - keycloak-network

  keycloak-nginx:
    image: nginx:latest
    container_name: keycloak-nginx
    ports:
      - "80:80"    # HTTP port (optional, for redirecting to HTTPS)
      - "443:443"  # HTTPS port
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf  # Mount custom Nginx config
      - ./nginx/certs:/etc/nginx/certs            # Mount SSL certificates
    depends_on:
      - keycloak-service
    restart: unless-stopped
    networks:
      - keycloak-network

volumes:
  keycloak-postgres-data:
    driver: local

networks:
  keycloak-network:
    driver: bridge