feat(keycloak): update entrypoint to handle certificate separation and adjust permissions

feat(postgres): restore schema-level privileges for Keycloak and app roles

Author: iLoveTux

services/keycloak/templates/agent.hcl.tpl

@@ -22,10 +22,11 @@ auto_auth {
 }
 
 # ---------------------------------------------------------------------------
-# TLS certificate — cert + CA chain + private key in one PEM bundle.
-# KC_HTTPS_CERTIFICATE_FILE and KC_HTTPS_CERTIFICATE_KEY_FILE both reference
-# this file; Quarkus reads cert blocks from the cert path and key blocks from
-# the key path, so a combined bundle works for both.
+# TLS certificate — single pkiCert call renders cert+chain+key in one bundle.
+# The entrypoint splits this into separate cert and key files for Keycloak
+# because KC_HTTPS_CERTIFICATE_FILE and KC_HTTPS_CERTIFICATE_KEY_FILE must
+# be distinct files. Two separate pkiCert calls would issue two different
+# certificates whose keys would not match.
 # ---------------------------------------------------------------------------
 
 template {
@@ -35,7 +36,7 @@ template {
 {{- end }}
 EOT
   destination = "/vault/certs/keycloak.pem"
-  perms       = "0640"
+  perms       = "0644"
 }
 
 # ---------------------------------------------------------------------------
@@ -61,6 +62,8 @@ template {
 {{- with secret "${kv_admin_path}" -}}
 KC_BOOTSTRAP_ADMIN_USERNAME={{ .Data.data.username }}
 KC_BOOTSTRAP_ADMIN_PASSWORD={{ .Data.data.password }}
+KEYCLOAK_ADMIN={{ .Data.data.username }}
+KEYCLOAK_ADMIN_PASSWORD={{ .Data.data.password }}
 {{- end }}
 EOT
   destination = "/vault/secrets/keycloak-admin.env"

services/keycloak/templates/compose.yml.tpl

@@ -41,21 +41,56 @@ services:
     image: ${keycloak_image}
     container_name: ${keycloak_container_name}
     restart: unless-stopped
-    command: ["start"]
+    entrypoint:
+      - "sh"
+      - "-ec"
+      - |
+        set -a
+        . /vault/secrets/keycloak.env
+        . /vault/secrets/keycloak-admin.env
+        # Split the combined PEM into separate cert+chain and key files.
+        # A single pkiCert template call is used to ensure cert and key match.
+        : > /tmp/keycloak.crt
+        : > /tmp/keycloak.key
+        in_cert="0"
+        in_key="0"
+        while IFS= read -r line; do
+          case "$$line" in
+            "-----BEGIN CERTIFICATE-----") in_cert="1" ;;
+            "-----END CERTIFICATE-----")
+              printf '%s\n' "$$line" >> /tmp/keycloak.crt
+              in_cert="0"
+              continue
+              ;;
+            "-----BEGIN EC PRIVATE KEY-----"|"-----BEGIN PRIVATE KEY-----") in_key="1" ;;
+            "-----END EC PRIVATE KEY-----"|"-----END PRIVATE KEY-----")
+              printf '%s\n' "$$line" >> /tmp/keycloak.key
+              in_key="0"
+              continue
+              ;;
+          esac
+
+          if [ "$$in_cert" = "1" ]; then
+            printf '%s\n' "$$line" >> /tmp/keycloak.crt
+          fi
+          if [ "$$in_key" = "1" ]; then
+            printf '%s\n' "$$line" >> /tmp/keycloak.key
+          fi
+        done < /vault/certs/keycloak.pem
+
+        test -s /tmp/keycloak.crt
+        test -s /tmp/keycloak.key
+        exec /opt/keycloak/bin/kc.sh start
     depends_on:
       vault-agent:
         condition: service_healthy
 
-    env_file:
-      - ${secrets_dir}/keycloak.env
-      - ${secrets_dir}/keycloak-admin.env
-
     environment:
       KC_DB: postgres
       KC_DB_URL: "jdbc:postgresql://${postgres_host}:5432/keycloak?ssl=true&sslmode=require"
       KC_DB_USERNAME: keycloak
-      KC_HTTPS_CERTIFICATE_FILE: /vault/certs/keycloak.pem
-      KC_HTTPS_CERTIFICATE_KEY_FILE: /vault/certs/keycloak.pem
+      KC_HTTPS_CERTIFICATE_FILE: /tmp/keycloak.crt
+      KC_HTTPS_CERTIFICATE_KEY_FILE: /tmp/keycloak.key
       KC_HOSTNAME_STRICT: "false"
       KC_HEALTH_ENABLED: "true"
 
@@ -66,13 +101,6 @@ services:
       - ${certs_dir}:/vault/certs:ro,z
       - ${secrets_dir}:/vault/secrets:ro,z
 
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:9000/health/ready"]
-      interval: 10s
-      timeout: 5s
-      retries: 12
-      start_period: 60s
-
     networks:
       - keycloak-net
 

services/postgres/templates/init.sql.tpl

@@ -35,6 +35,14 @@ CREATE ROLE app_role NOLOGIN;
 GRANT ALL PRIVILEGES ON DATABASE app TO app_role;
 GRANT app_role TO vault_mgmt WITH ADMIN OPTION;
 
+-- PostgreSQL 15+ revokes CREATE on public schema from PUBLIC by default.
+-- Restore schema-level privileges so Keycloak and app roles can create tables.
+\connect keycloak
+GRANT ALL ON SCHEMA public TO keycloak_role;
+\connect app
+GRANT ALL ON SCHEMA public TO app_role;
+\connect postgres
+
 -- Keycloak application account -----------------------------------------------
 -- Managed by Vault Database static role. Initial password is a placeholder;
 -- Vault rotates it to a random value when the static role is first read.