# docker-compose-keycloak.yml
# ============================================
# Keycloak integration test environment.
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose-keycloak.yml up
#
# This extends the base docker-compose.yml to add:
#   - Keycloak IdP with a pre-configured "switchboard" realm
#   - Switchboard configured with AUTH_MODE=oidc pointing at Keycloak
#
# After startup:
#   Switchboard:  http://localhost:3000
#   Keycloak:     http://localhost:8180  (admin / admin)
#
# Pre-configured test users in Keycloak:
#   alice / alice123  (role: user,  groups: [engineering])
#   bob   / bob123    (role: admin, groups: [engineering, leads])
#
# The realm is imported from ci/keycloak-realm.json on first startup.
# ============================================

services:
  # Override switchboard to use OIDC
  switchboard:
    environment:
      AUTH_MODE: oidc
      OIDC_ISSUER_URL: http://keycloak:8080/realms/switchboard
      OIDC_EXTERNAL_ISSUER_URL: http://localhost:8180/realms/switchboard
      OIDC_CLIENT_ID: switchboard
      OIDC_CLIENT_SECRET: switchboard-secret
      OIDC_REDIRECT_URL: http://localhost:3000/api/v1/auth/oidc/callback
      OIDC_AUTO_ACTIVATE: "true"
      OIDC_ADMIN_ROLE: sb-admin
    depends_on:
      keycloak:
        condition: service_healthy

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    container_name: switchboard-keycloak
    command:
      - start-dev
      - --import-realm
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HTTP_PORT: "8080"
      KC_HEALTH_ENABLED: "true"
    volumes:
      - ./ci/keycloak-realm.json:/opt/keycloak/data/import/switchboard-realm.json:ro
    ports:
      - "8180:8080"
    healthcheck:
      test: ["CMD-SHELL", "cat < /dev/null > /dev/tcp/localhost/9000"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s