mocode-software/meldestelle
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

infra: clean up Keycloak configuration, enforce consistency in .env, and improve health checks

Browse Source 
Streamlined Keycloak configurations with defaults for development and production in `.env`. Added health checks and improved environment variable documentation with comments to differentiate local and server deployments. Ensured compatibility with pre-built registry images.
This commit is contained in:
Stefan Mogeritsch
2026-03-06 11:23:24 +01:00
parent 6cb1f2d5ba
commit 09b0b1a462
75 changed files with 441 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+31 -12
View File
@@ -2,12 +2,21 @@
# Meldestelle – Docker Compose Environment
# Single Source of Truth (SSoT)
# ==========================================
# WARNING: This file contains secrets (passwords).
# Do NOT commit this file to version control if it contains production secrets.
# ANLEITUNG:
# 1. Diese Datei nach ".env" kopieren: cp .env.example .env
# 2. Alle Werte mit <PLACEHOLDER> durch echte Werte ersetzen
# 3. Für lokale Entwicklung: KC_COMMAND=start-dev --import-realm
# Für Server/Produktion: KC_COMMAND=start --optimized --import-realm
# WARNING: Die .env-Datei enthält Secrets – NIEMALS in Git committen!
# --- PROJECT ---
PROJECT_NAME=meldestelle
# --- BACKUP ---
# SERVER: Pfad zum Backup-Verzeichnis (z.B. /home/<USER>/backups/meldestelle)
BACKUP_DIR=/home/<USER>/backups/meldestelle
BACKUP_RETENTION_DAYS=7
# Docker build versions (optional overrides)
DOCKER_VERSION=1.0.0-SNAPSHOT
DOCKER_BUILD_DATE=2026-02-02T15:00:00Z
@@ -37,22 +46,32 @@ VALKEY_MAXMEMORY=256mb
# --- KEYCLOAK ---
KEYCLOAK_IMAGE_TAG=26.4
KC_HEAP_MAX=1024m
KC_COMMAND=start-dev --import-realm
KC_HEAP_MIN=512M
KC_HEAP_MAX=1024M
# LOKAL: start-dev --import-realm
# SERVER: start --optimized --import-realm ← pre-built Registry-Image, kein start-dev!
KC_COMMAND=start --optimized --import-realm
KC_ADMIN_USERNAME=kc-admin
KC_ADMIN_PASSWORD=kc-password
KC_ADMIN_PASSWORD=<SICHERES_PASSWORT>
KC_DB=postgres
KC_DB_SCHEMA=keycloak
KC_DB_PASSWORD=meldestelle
KC_HOSTNAME=localhost
KC_DB_PASSWORD=<SICHERES_PASSWORT>
# SERVER: Echte IP oder Domain eintragen (z.B. 192.168.1.100 oder auth.meldestelle.at)
# LOKAL: localhost
KC_HOSTNAME=<SERVER_IP_ODER_DOMAIN>
# false = Zugriff über beliebige Hostnamen erlaubt (nötig ohne TLS / für HTTP-Betrieb)
KC_HOSTNAME_STRICT=false
KC_HOSTNAME_STRICT_HTTPS=false
KC_PORT=8180:8080
KC_DEBUG_PORT=9000:9000
KC_MANAGEMENT_PORT=9000:9000
# --- KEYCLOAK TOKEN VALIDATION ---
# Public Issuer URI (must match the token issuer from browser/postman)
KC_ISSUER_URI=http://localhost:8180/realms/meldestelle
# Internal JWK Set URI (for service-to-service communication within Docker)
KC_JWK_SET_URI=http://keycloak:8080/realms/meldestelle/protocol/openid-connect/certs
# Public Issuer URI: muss mit dem Hostname übereinstimmen, den Browser/App sieht
# LOKAL: http://localhost:8180/realms/meldestelle
# SERVER: http://<SERVER_IP_ODER_DOMAIN>:8180/realms/meldestelle
SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI=http://<SERVER_IP_ODER_DOMAIN>:8180/realms/meldestelle
# Internal JWK Set URI: Service-zu-Service innerhalb Docker (immer keycloak:8080)
SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI=http://keycloak:8080/realms/meldestelle/protocol/openid-connect/certs
# --- CONSUL ---
CONSUL_IMAGE=hashicorp/consul:1.22.1