af354a4b9e
Subdomain rename (Versio side keeps original tool-named hostnames)
- nginx vhosts updated:
grafana -> dash.wbd-rd.nl
gitea -> git.wbd-rd.nl
keycloak -> auth.wbd-rd.nl
node-red -> flow.wbd-rd.nl
mlflow -> ml.wbd-rd.nl
jupyter -> hub.wbd-rd.nl
portainer -> ops.wbd-rd.nl
rabbitmq -> mq.wbd-rd.nl
jenkins -> ci.wbd-rd.nl
mqtt -> mqtt.wbd-rd.nl (no Versio conflict assumed)
- nginx-proxy README: bootstrap cert -d list + DNS A-record prereqs updated
- cloud/.env.example: GITEA_ROOT_URL, GRAFANA_ROOT_URL, KEYCLOAK_HOSTNAME
Function-based names are tool-agnostic (a Grafana -> Kibana swap leaves
dash.wbd-rd.nl meaningful) and avoid one-off "*2" suffixes.
Keycloak hardening
- Switch backend from bundled file storage to postgres (keycloak DB
already provisioned by sql/config/init.d/01-databases.sh).
- KC_HOSTNAME=auth.wbd-rd.nl, KC_PROXY_HEADERS=xforwarded for nginx
reverse-proxy posture; KC_HTTP_ENABLED=true since nginx terminates TLS.
- Added KC_HOSTNAME_STRICT, KC_HEALTH_ENABLED, KC_METRICS_ENABLED.
- Service joins app + mgmt + data networks (data needed for postgres).
- Mounted config/realms/ for realm-as-code (kc.sh import) — TODO to
populate once realm + clients are designed.
- README documents the recommended realm structure (wbd realm, one
client per app with redirect URIs) and the oauth2-proxy approach
for apps without native OIDC (mlflow, portainer-CE).
cloud
- Uncomment keycloak include in cloud/compose.yml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
# keycloak — identity / SSO
|
|
# Hostname: auth.wbd-rd.nl (reverse-proxied via nginx-proxy on port 8080)
|
|
# Networks: app (relying-party endpoints) + mgmt (admin console traffic) + data (postgres backend)
|
|
|
|
services:
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.0
|
|
restart: unless-stopped
|
|
command: ["start"]
|
|
networks: [app, mgmt, data]
|
|
environment:
|
|
# Master admin bootstrap (first start only — change password after first login)
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN}
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
|
|
# Reverse-proxy posture
|
|
KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
|
|
KC_HOSTNAME_STRICT: "true"
|
|
KC_PROXY_HEADERS: xforwarded
|
|
KC_HTTP_ENABLED: "true"
|
|
# Postgres backend (DB + role provisioned by sql/config/init.d/01-databases.sh)
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://sql:5432/keycloak
|
|
KC_DB_USERNAME: keycloak
|
|
KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
|
|
# Misc
|
|
KC_HEALTH_ENABLED: "true"
|
|
KC_METRICS_ENABLED: "true"
|
|
TZ: ${TZ:-Europe/Amsterdam}
|
|
volumes:
|
|
- keycloak-data:/opt/keycloak/data
|
|
- ./config/realms:/opt/keycloak/data/import:ro
|
|
|
|
networks:
|
|
app:
|
|
mgmt:
|
|
data:
|
|
|
|
volumes:
|
|
keycloak-data:
|