docker-compose.yml

---
x-logging-json:
  &json-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "10"

services:
  postgres:
    image: "postgres:${POSTGRES_VERSION}"
    healthcheck:
      test: ["CMD", "nc", "-zv", "localhost", "5432"]
      interval: 1s
      timeout: 10s
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: password
      PGPASSWORD: password
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 525M
    security_opt:
      - no-new-privileges:true
    networks:
      - keycloak
    logging: *json-logging

  keycloak:
    image: "quay.io/keycloak/keycloak:${KC_VERSION}"
    command: ["start-dev", "--import-realm"]
    restart: unless-stopped
    depends_on:
      - postgres
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/health/ready"]
    environment:
      - KC_DB=postgres
      - KC_DB_USERNAME=keycloak
      - KC_DB_PASSWORD=password
      - KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
      - KC_METRICS_ENABLED=true
      - KC_HEALTH_ENABLED=true
      - KC_LOG=console # can use 'gelf' https://www.keycloak.org/server/logging#_centralized_logging_using_gelf
      - KC_LOG_LEVEL=${KC_LOG_LEVEL}
      - KC_LOG_CONSOLE_OUTPUT=json
      - KC_FEATURES=${KC_FEATURES}
      - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN}
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD}
      - KC_REALM_NAME=${KC_REALM_NAME}
      - GRAFANA_ADMIN_USERNAME=${GRAFANA_ADMIN_USERNAME}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GRAFANA_URL=${GRAFANA_HOSTNAME}:${GF_SERVER_HTTP_PORT}
    ports:
      - ${KC_PORT}:8080
    volumes:
      - ./realms/realm.json:/opt/keycloak/data/import/realm.json:ro
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 1100M
    security_opt:
      - no-new-privileges:true
    networks:
      - keycloak
      - monitoring
    logging: *json-logging

  prometheus:
    image: "prom/prometheus:${PROMETHEUS_VERSION}"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
      - '--storage.tsdb.wal-compression'
      - '--web.enable-lifecycle'
    restart: unless-stopped
    depends_on:
      - keycloak
    healthcheck:
      test: ["CMD", "wget", "--tries=1", "--spider", "http://localhost:9090"]
      interval: 1s
      timeout: 10s
    ports:
      - ${PROMETHEUS_PORT}:9090
    volumes:
      - prometheus_data:/prometheus
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    deploy:
      resources:
        limits:
          cpus: '0.2'
          memory: 525M
    security_opt:
      - no-new-privileges:true
    networks:
      - monitoring
    logging: *json-logging

  grafana:
    image: "grafana/grafana:${GRAFANA_VERSION}"
    restart: unless-stopped
    network_mode: host
    depends_on:
      - prometheus
    healthcheck:
      test: ["CMD", "wget", "--tries=1", "--spider", "http://localhost:${GF_SERVER_HTTP_PORT}"]
      interval: 1s
      timeout: 10s
    environment:
      - GF_SERVER_HTTP_PORT=${GF_SERVER_HTTP_PORT}
      - GF_PLUGINS_ENABLE_ALPHA=true
      - GF_PLUGINS_PLUGIN_ADMIN_ENABLED=true
      - GF_LOG_MODE=console
      - GF_AUTH_BASIC_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_TLS_SKIP_VERIFY_INSECURE=true
      - GF_AUTH_DISABLE_LOGIN_FORM=true
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
      - GF_AUTH_GENERIC_OAUTH_EMAIL_ATTRIBUTE_NAME=email:primary
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=${KC_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${KC_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=${KC_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/userinfo
    volumes:
      - ./monitoring/datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml:ro
      - ./monitoring/dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
      - ./monitoring/dashboards:/etc/grafana/provisioning/dashboards/keycloak:ro
    deploy:
      resources:
        limits:
          cpus: '0.3'
          memory: 1100M
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

networks:
  keycloak:
  monitoring:

volumes:
  prometheus_data: {}