Niek Otten
b349dff496
Drops the inline-build images for the upstream services. The compose now references the published images directly (openzaak/open-zaak, openzaak/open-notificaties, keycloak, curl, flowable-rest) with no build for them, and the config they need is streamed into external named volumes by infra/seed-config.sh: rr-oz-config -> oz-init /app/setup_configuration (data.yaml) rr-kc-realms -> keycloak /opt/keycloak/data/import (realm exports) rr-fl-bpmn -> flowable-init /work (registratie.bpmn) How: the seeder creates each volume, `docker create`s a throwaway helper that mounts it, `docker cp`s the files in, and removes it. docker cp streams over the Docker API, so it works in Docker-in-Docker (the CI runner) where bind mounts mount empty. It uses plain `docker create`/`cp` — NOT `docker compose create`, which podman-compose (local dev) lacks. `external: true` fixed names keep the volumes identical across docker compose and podman-compose. Consequence: bare `docker compose up` no longer self-seeds, so use `make up` (seeds then starts). Every `*-up` target seeds first; `*-down` removes the external volume. acl/bff are still built (they're our apps, not upstream images). Verified end-to-end on podman-compose: `make keycloak-up` seeds rr-kc-realms, the upstream Keycloak mounts it, and --import-realm imports all four realms (digid realm returns 200). Seeder runs in ~2s. Docs updated: gitea-actions-gotchas.md, ci.md, openzaak.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# Keycloak (S-02) with four pre-seeded realms imported at boot:
|
|
# digid · eherkenning · eidas · medewerker
|
|
# Dev mode, H2 in-memory store, realm JSONs imported from ./realms.
|
|
#
|
|
# docker compose -f infra/keycloak/docker-compose.yml up -d
|
|
# curl -s -o /dev/null -w '%{http_code}\n' \
|
|
# http://localhost:8180/realms/digid/.well-known/openid-configuration # -> 200
|
|
#
|
|
# Admin console: http://localhost:8180/ (admin / admin — dev only)
|
|
services:
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.1
|
|
command: ["start-dev", "--import-realm"]
|
|
environment:
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: admin
|
|
# Older var names too, harmless on 26.x:
|
|
KEYCLOAK_ADMIN: admin
|
|
KEYCLOAK_ADMIN_PASSWORD: admin
|
|
KC_HEALTH_ENABLED: "true"
|
|
KC_HTTP_ENABLED: "true"
|
|
ports:
|
|
- "8180:8080"
|
|
# realm exports are streamed into this external volume by infra/seed-config.sh.
|
|
volumes:
|
|
- kc-realms:/opt/keycloak/data/import:ro
|
|
networks: [cg]
|
|
|
|
volumes:
|
|
kc-realms:
|
|
external: true
|
|
name: rr-kc-realms
|
|
|
|
networks:
|
|
cg:
|