-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathkeycloak-traefik-letsencrypt-docker-compose.yml
175 lines (164 loc) · 6.89 KB
/
keycloak-traefik-letsencrypt-docker-compose.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
# Keycloak with Let's Encrypt in a Docker Compose
# Vladimir Mikhalev
# www.heyvaldemar.com
# Install the Docker Engine by following the official guide: https://docs.docker.com/engine/install/
# Install the Docker Compose by following the official guide: https://docs.docker.com/compose/install/
# Run keycloak-restore-database.sh to restore database if needed.
# Deploy Keycloak server with a Docker Compose using the command:
# docker-compose -f keycloak-traefik-letsencrypt-docker-compose.yml -p keycloak up -d
volumes:
keycloak-postgres:
keycloak-postgres-backups:
traefik-certificates:
services:
postgres:
# Image tag (replace with yours)
image: postgres:13.2
volumes:
- keycloak-postgres:/var/lib/postgresql/data
environment:
# Database name (replace with yours)
POSTGRES_DB: keycloakdb
# Database user (replace with yours)
POSTGRES_USER: keycloakdbuser
# Database password (replace with yours)
POSTGRES_PASSWORD: EqhvLbsPhrkkZjcaGWcV7qT
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres -h 127.0.0.1"]
interval: 10s
timeout: 5s
retries: 3
start_period: 60s
restart: unless-stopped
keycloak:
# Image tag (replace with yours)
image: jboss/keycloak:13.0.0
environment:
DB_VENDOR: postgres
DB_ADDR: postgres
DB_PORT: 5432
# Database name (replace with yours)
DB_DATABASE: keycloakdb
# Database user (replace with yours)
DB_USER: keycloakdbuser
# Database password (replace with yours)
DB_PASSWORD: EqhvLbsPhrkkZjcaGWcV7qT
# Keycloak user (replace with yours)
KEYCLOAK_USER: keycloakadmin
# Keycloak password (replace with yours)
KEYCLOAK_PASSWORD: rwXPqspCABJzqh47i723wf9
JGROUPS_DISCOVERY_PROTOCOL: JDBC_PING
JGROUPS_DISCOVERY_PROPERTIES: datasource_jndi_name=java:jboss/datasources/KeycloakDS,info_writer_sleep_time=500,initialize_sql="CREATE TABLE IF NOT EXISTS JGROUPSPING ( own_addr varchar(200) NOT NULL, cluster_name varchar(200) NOT NULL, created timestamp default current_timestamp, ping_data BYTEA, constraint PK_JGROUPSPING PRIMARY KEY (own_addr, cluster_name))"
PROXY_ADDRESS_FORWARDING: 'true'
KEYCLOAK_LOGLEVEL: WARN
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080/"]
interval: 10s
timeout: 5s
retries: 3
start_period: 120s
labels:
- "traefik.enable=true"
# Keycloak URL (replace with yours)
- "traefik.http.routers.keycloak.rule=Host(`keycloak.heyvaldemar.net`)"
- "traefik.http.routers.keycloak.service=keycloak"
- "traefik.http.routers.keycloak.entrypoints=websecure"
- "traefik.http.services.keycloak.loadbalancer.server.port=8080"
- "traefik.http.routers.keycloak.tls=true"
- "traefik.http.routers.keycloak.tls.certresolver=letsencrypt"
- "traefik.http.services.keycloak.loadbalancer.passhostheader=true"
- "traefik.http.routers.keycloak.middlewares=compresstraefik"
- "traefik.http.middlewares.compresstraefik.compress=true"
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
traefik:
condition: service_healthy
traefik:
# Image tag (replace with yours)
image: traefik:2.4
command:
- "--log.level=WARN"
- "--accesslog=true"
- "--api.dashboard=true"
- "--api.insecure=true"
- "--ping=true"
- "--ping.entrypoint=ping"
- "--entryPoints.ping.address=:8082"
- "--entryPoints.web.address=:80"
- "--entryPoints.websecure.address=:443"
- "--providers.docker=true"
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.exposedByDefault=false"
- "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
# Email for Let's Encrypt (replace with yours)
- "--certificatesresolvers.letsencrypt.acme.email=callvaldemar@gmail.com"
- "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json"
- "--metrics.prometheus=true"
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
- "--global.checkNewVersion=true"
- "--global.sendAnonymousUsage=false"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- traefik-certificates:/etc/traefik/acme
ports:
- "80:80"
- "443:443"
healthcheck:
test: ["CMD", "wget", "http://localhost:8082/ping","--spider"]
interval: 10s
timeout: 5s
retries: 3
start_period: 5s
labels:
- "traefik.enable=true"
# Traefik URL (replace with yours)
- "traefik.http.routers.dashboard.rule=Host(`traefik.keycloak.heyvaldemar.net`)"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.dashboard.entrypoints=websecure"
- "traefik.http.services.dashboard.loadbalancer.server.port=8080"
- "traefik.http.routers.dashboard.tls=true"
- "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
- "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
- "traefik.http.routers.dashboard.middlewares=authtraefik"
# Basic Authentication for Traefik Dashboard
# Username: traefikadmin (replace with yours)
# Passwords must be encoded using MD5, SHA1, or BCrypt
- "traefik.http.middlewares.authtraefik.basicauth.users=traefikadmin:$$2y$$10$$sMzJfirKC75x/hVpiINeZOiSm.Jkity9cn4KwNkRvO7hSQVFc5FLO"
- "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
- "traefik.http.routers.http-catchall.entrypoints=web"
- "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
restart: unless-stopped
backups:
# Image tag (replace with yours)
image: postgres:13.2
# Database backups prune interval (replace with yours). Default is 7 days.
# find /srv/keycloak-postgres/backups -type f -mtime +7 | xargs rm -f
# Keycloak backups interval (replace with yours). Default is 1 day.
# sleep 24h
# Run keycloak-restore-database.sh to restore database if needed.
command: sh -c 'sleep 30m
&& while true; do
PGPASSWORD="$$(echo $$POSTGRES_PASSWORD)"
pg_dump
-h postgres
-p 5432
-d keycloakdb
-U keycloakdbuser | gzip > /srv/keycloak-postgres/backups/keycloak-postgres-backup-$$(date "+%Y-%m-%d_%H-%M").gz
&& find /srv/keycloak-postgres/backups -type f -mtime +7 | xargs rm -f;
sleep 24h; done'
volumes:
# Database backups location
- keycloak-postgres-backups:/srv/keycloak-postgres/backups
environment:
# Database password (replace with yours)
POSTGRES_PASSWORD: EqhvLbsPhrkkZjcaGWcV7qT
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
keycloak:
condition: service_healthy