infra/stacks/node-red/compose.yml

# node-red — flow-based automation runtime + editor
# Networks: app
# UI: internal port 1880 → reverse-proxied through nginx-proxy

services:
  node-red:
    build:
      context: .                # custom image: upstream + passport-openidconnect for Keycloak SSO
      dockerfile: Dockerfile
    image: cloud-node-red:4.1
    restart: unless-stopped
    networks: [app]
    volumes:
      - node-red-data:/data
      - ./config/settings.js:/data/settings.js:ro
    environment:
      TZ: ${TZ:-Europe/Amsterdam}
      # Keycloak OIDC (wbd realm, node-red client)
      NODERED_OAUTH_CLIENT_ID: ${NODERED_OAUTH_CLIENT_ID:-node-red}
      NODERED_OAUTH_CLIENT_SECRET: ${NODERED_OAUTH_CLIENT_SECRET}
      # Comma-separated usernames/emails. These get permissions "*". Anyone else
      # in the Keycloak realm gets "read" (cannot deploy).
      NODERED_ADMIN_USERS: ${NODERED_ADMIN_USERS}

networks:
  app:

volumes:
  node-red-data: