compose.auth.yml

name: neosync

services:
  app:
    environment:
      - AUTH_ENABLED=true
      - AUTH_ISSUER=http://keycloak:8080/realms/neosync
      - AUTH_EXPECTED_ISSUER=http://localhost:8083/realms/neosync
      - AUTH_AUTHORIZE_URL=http://localhost:8083/realms/neosync/protocol/openid-connect/auth
      - AUTH_USERINFO_URL=http://keycloak:8080/realms/neosync/protocol/openid-connect/userinfo
      - AUTH_TOKEN_URL=http://keycloak:8080/realms/neosync/protocol/openid-connect/token
      - AUTH_LOGOUT_URL=http://localhost:8083/realms/neosync/protocol/openid-connect/logout

      - AUTH_CLIENT_ID=neosync-app
      - AUTH_CLIENT_SECRET=72alWGzhHInDskRHduTQ8BjB4Lgn0n3a
      - AUTH_AUDIENCE=neosync
      - AUTH_SCOPE=openid email profile offline_access
      - AUTH_PROVIDER_ID=keycloak
      - AUTH_PROVIDER_NAME=Keycloak

    networks:
      - kc-network

  api:
    environment:
      - AUTH_ENABLED=true
      - AUTH_AUDIENCE=neosync
      - AUTH_BASEURL=http://keycloak:8080/realms/neosync
      - AUTH_EXPECTED_ISS=http://localhost:8083/realms/neosync
      - AUTH_CLI_CLIENT_ID=neosync-cli
      - AUTH_CLI_AUDIENCE=neosync
      - AUTH_CLIENTID_SECRET={"neosync-cli":"GkVsthDzDvBfzb2vT4UO95xbXrwoXE5w"}
      - AUTH_SIGNATURE_ALGORITHM=RS256

    networks:
      - kc-network

  db:
    networks:
      - kc-network

  keycloak:
    container_name: neosync-auth-keycloak
    image: quay.io/keycloak/keycloak
    ports:
      - 8083:8080
    command: start-dev --import-realm
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=change_me

      - KC_HOSTNAME_URL=http://localhost:8083

      - KC_DB=postgres
      - KC_DB_URL_HOST=db
      - KC_DB_URL_PORT=5432
      - KC_DB_URL_DATABASE=nucleus
      - KC_DB_USERNAME=postgres
      - KC_DB_PASSWORD=foofar
      - KC_DB_SCHEMA=keycloak
    volumes:
      - ./keycloak/imports:/opt/keycloak/data/import
    networks:
      - kc-network
    depends_on:
      db:
        condition: service_healthy
        restart: true

networks:
  kc-network:
    name: kc-network