version: '3.8'

# IMPORTANT: Pour la production, créez un fichier .env avec les variables suivantes:
# KEYCLOAK_ADMIN_USER=admin
# KEYCLOAK_ADMIN_PASSWORD=<mot_de_passe_securise>
# KC_DB_USERNAME=keycloak
# KC_DB_PASSWORD=<mot_de_passe_securise>
# KC_HOSTNAME=<votre_hostname_production>
# POSTGRES_PASSWORD=<mot_de_passe_securise>

services:
  keycloak:
    image: quay.io/keycloak/keycloak:23.0.0
    container_name: unionflow-keycloak
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN_USER:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?KEYCLOAK_ADMIN_PASSWORD is required}
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: ${KC_DB_USERNAME:-keycloak}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD:?KC_DB_PASSWORD is required}
      KC_HOSTNAME: ${KC_HOSTNAME:-localhost}
      KC_HOSTNAME_PORT: ${KC_HOSTNAME_PORT:-8180}
      KC_HTTP_ENABLED: ${KC_HTTP_ENABLED:-false}
      KC_HTTPS_ENABLED: ${KC_HTTPS_ENABLED:-true}
      KC_HTTP_PORT: 8180
      KC_HOSTNAME_STRICT: ${KC_HOSTNAME_STRICT:-true}
      KC_HOSTNAME_STRICT_HTTPS: ${KC_HOSTNAME_STRICT_HTTPS:-true}
    ports:
      - "${KC_HOST_PORT:-8180}:8180"
    depends_on:
      postgres:
        condition: service_healthy
    command: start --optimized
    networks:
      - unionflow-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8180/health/ready || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  postgres:
    image: postgres:15
    container_name: unionflow-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-keycloak}
      POSTGRES_USER: ${KC_DB_USERNAME:-keycloak}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "${POSTGRES_HOST_PORT:-5432}:5432"
    networks:
      - unionflow-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${KC_DB_USERNAME:-keycloak} -d ${POSTGRES_DB:-keycloak}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

volumes:
  postgres_data:
    driver: local

networks:
  unionflow-network:
    driver: bridge