keycloak.yml

version: "3.9"
# tips : OTP disablle : authentication -> browser -> browser - Conditional OTP -> Disabled
# tips : avoid CORS error : configure web origins in client
# tips : if keycloak does not allow login login valid redirect URIs need to be set in client settings
# tips : avoid expired sessions : realm settings -> tokens -> access token lifespan -> 1 Days, or clients -> advanced -> advanced settings -> first 4 lines to 1 Days,
#        or realm settings -> sessions -> SSO somethings -> 1 Days
# tips : public key : realm settings -> keys -> active keys -> RS256
# tips : to allow minio login : client scopes -> create client scope -> consoleAdmin, 
#        then click consoleAdmin -> mappers -> add mapper -> by configuration -> Hardcoded claim -> tokenClaimName : policy, token claim value : consoleAdmin,
#        then on main menu click clients -> your-client -> client scopes -> Add client scope -> consoleAdmin
services:
  keycloak:
    image: quay.io/keycloak/keycloak:26.0.2 
    container_name: keycloak
    command:
      - start-dev   # only in development, for production use 'start', https protocol and cert
    environment:
      KEYCLOAK_ADMIN: admin        
      KEYCLOAK_ADMIN_PASSWORD: admin 
      KC_DB: postgres
      KC_DB_URL_HOST: db
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
    ports:
      - "8080:8080"
    restart: unless-stopped
    depends_on:
      - db

  db:
    image: postgres:16
    container_name: keycloak-db
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak
    volumes:
      - keycloak-db-data:/var/lib/postgresql/data
    restart: unless-stopped

volumes:
  keycloak-db-data: