Skip to content

Commit 3cb3823

Browse files
nmorenornmorenor
authored
Prepare docker compose examples with keycloak. (#151)
1 parent a778d1b commit 3cb3823

4 files changed

Lines changed: 377 additions & 0 deletions

File tree

‎compose/.env-with-keycloak-template‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
###############################################################################
2+
# CodeTogether – Environment Template
3+
# -----------------------------------------------------------------------------
4+
# 1. Copy this file to `.env` in the same directory as `compose.yaml`.
5+
# 2. Replace the placeholders on the right‑hand side with your real values.
6+
# 3. Place all SSL certificates and Diffie‑Hellman parameters in the
7+
# `nginx/ssl` directory.
8+
# 4. Configure your SSO provider in the `cthq.properties` file.
9+
# 5. Run `docker‑compose up -d` to start the containers.
10+
#
11+
# Variables (all required unless stated otherwise)
12+
# ----------------------------------------------
13+
# COLLAB_FQDN Public hostname (FQDN) that end‑users hit to reach the
14+
# Collab service (e.g. collab.example.com).
15+
#
16+
# INTEL_FQDN Public hostname (FQDN) for the Intel service
17+
# (e.g. intel.example.com).
18+
#
19+
# INTEL_SECRET Shared secret Collab uses to authenticate when
20+
# communicating with the Intel service. Use a strong,
21+
# private value.
22+
#
23+
# SSL_COLLAB_CERT Certificate filename that Nginx serves for the Collab
24+
# virtual host (e.g. ssl-collab.crt).
25+
#
26+
# SSL_COLLAB_KEY Private key filename for the Collab certificate
27+
# (e.g. ssl-collab.key).
28+
#
29+
# SSL_INTEL_CERT Certificate filename for the Intel virtual host
30+
# (e.g. ssl-intel.crt).
31+
#
32+
# SSL_INTEL_KEY Private key filename for the Intel certificate
33+
# (e.g. ssl-intel.key).
34+
#
35+
# DHPARAM_PEM Diffie‑Hellman parameters file (e.g. dhparam.pem).
36+
###############################################################################
37+
38+
COLLAB_FQDN=collab.example.com
39+
INTEL_FQDN=intel.example.com
40+
INTEL_SECRET=super-secret-string
41+
42+
# SSL cerfificate files should be placed in the `nginx/ssl` directory.
43+
SSL_COLLAB_CERT=ssl-collab.crt
44+
SSL_COLLAB_KEY=ssl-collab.key
45+
46+
SSL_INTEL_CERT=ssl-intel.crt
47+
SSL_INTEL_KEY=ssl-intel.key
48+
49+
DHPARAM_PEM=dhparam.pem
50+
51+
KEYCLOAK_FQDN=keycloak.example.com
52+
SSL_KEYCLOAK_CERT=ssl-keycloak.crt
53+
SSL_KEYCLOAK_KEY=ssl-keycloak.key
54+
55+
KEYCLOAK_DB_USERNAME=keycloak
56+
KEYCLOAK_DB_PASSWORD=keycloak
57+
58+
KEYCLOAK_ADMIN_PASSWORD=keycloak
59+
KEYCLOAK_ADMIN=admin
60+
61+
# Uncomment the following lines to enable AI integration with Ollama
62+
#CT_HQ_OLLAMA_AI_URL=http://codetogether-llm:8000
63+
#CT_HQ_OLLAMA_AI_MODEL_NAME=gemma3:1b

‎compose/keycloak/compose-keycloak-no-nginx.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# 👇 Rename `.env-template` to `.env` before running this file
2+
# Set the appropriate values once renamed
3+
services:
4+
# Relational database for Keycloak (optional)
5+
codetogether-mysql:
6+
image: mysql:8.0
7+
container_name: codetogether-mysql
8+
restart: unless-stopped
9+
env_file:
10+
- .env
11+
environment:
12+
MYSQL_ROOT_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
13+
MYSQL_DATABASE: keycloak
14+
MYSQL_USER: ${KEYCLOAK_DB_USERNAME}
15+
MYSQL_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
16+
volumes:
17+
- mysql_data:/var/lib/mysql
18+
networks:
19+
- codetogethernet
20+
healthcheck:
21+
test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
22+
interval: 10s
23+
timeout: 10s
24+
retries: 30
25+
26+
# Keycloak service (optional)
27+
codetogether-keycloak:
28+
image: quay.io/keycloak/keycloak:latest
29+
container_name: codetogether-keycloak
30+
env_file:
31+
- .env
32+
depends_on:
33+
codetogether-mysql:
34+
condition: service_healthy
35+
command:
36+
- "start"
37+
environment:
38+
# Admin credentials
39+
KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
40+
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
41+
42+
# Database connectivity
43+
KC_DB: mysql
44+
KC_DB_USERNAME: ${KEYCLOAK_DB_USERNAME:-root}
45+
KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
46+
KC_DB_URL_HOST: codetogether-mysql
47+
48+
# Feature flags & observability
49+
KC_FEATURES: token-exchange
50+
KC_HEALTH_ENABLED: "true"
51+
KC_METRICS_ENABLED: "true"
52+
53+
# Reverse‑proxy / HTTP
54+
KC_HTTP_ENABLED: "true"
55+
KC_PROXY: edge
56+
KC_PROXY_HEADERS: xforwarded
57+
KC_HOSTNAME_STRICT: "false"
58+
KC_HOSTNAME_STRICT_HTTPS: "false"
59+
KC_HOSTNAME: ${KEYCLOAK_FQDN}
60+
KC_FRONTEND_URL: https://${KEYCLOAK_FQDN}
61+
KC_HTTP_PORT: 8080
62+
networks:
63+
- codetogethernet
64+
healthcheck:
65+
test: ["CMD-SHELL", "echo > /dev/tcp/localhost/8080 || exit 1"]
66+
interval: 10s
67+
timeout: 5s
68+
retries: 5
69+
start_period: 30s
70+
71+
volumes:
72+
mysql_data:
73+
74+
networks:
75+
codetogethernet:
76+
driver: bridge

‎compose/keycloak/compose-keycloak.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# 👇 Rename `.env-template` to `.env` before running this file
2+
# Set the appropriate values once renamed
3+
services:
4+
# Relational database for Keycloak (optional)
5+
codetogether-mysql:
6+
image: mysql:8.0
7+
container_name: codetogether-mysql
8+
restart: unless-stopped
9+
env_file:
10+
- .env
11+
environment:
12+
MYSQL_ROOT_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
13+
MYSQL_DATABASE: keycloak
14+
MYSQL_USER: ${KEYCLOAK_DB_USERNAME}
15+
MYSQL_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
16+
volumes:
17+
- mysql_data:/var/lib/mysql
18+
networks:
19+
- codetogethernet
20+
healthcheck:
21+
test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
22+
interval: 10s
23+
timeout: 10s
24+
retries: 30
25+
# Nginx reverse proxy for Keycloak (optional)
26+
codetogether-keycloak-nginx:
27+
image: nginx:latest
28+
container_name: codetogether-keycloak-nginx
29+
env_file:
30+
- .env
31+
environment:
32+
- NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx
33+
ports:
34+
- "443:443"
35+
volumes:
36+
- ./nginx/nginx.conf.template:/etc/nginx/templates/nginx.conf.template:ro
37+
- ./nginx/ssl:/etc/nginx/ssl
38+
- ./nginx/log:/var/log/nginx
39+
networks:
40+
- codetogethernet
41+
depends_on:
42+
codetogether-keycloak:
43+
condition: service_healthy
44+
45+
# Keycloak service (optional)
46+
codetogether-keycloak:
47+
image: quay.io/keycloak/keycloak:latest
48+
container_name: codetogether-keycloak
49+
env_file:
50+
- .env
51+
depends_on:
52+
codetogether-mysql:
53+
condition: service_healthy
54+
command:
55+
- "start"
56+
environment:
57+
# Admin credentials
58+
KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
59+
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
60+
61+
# Database connectivity
62+
KC_DB: mysql
63+
KC_DB_USERNAME: ${KEYCLOAK_DB_USERNAME:-root}
64+
KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
65+
KC_DB_URL_HOST: codetogether-mysql
66+
67+
# Feature flags & observability
68+
KC_FEATURES: token-exchange
69+
KC_HEALTH_ENABLED: "true"
70+
KC_METRICS_ENABLED: "true"
71+
72+
# Reverse‑proxy / HTTP
73+
KC_HTTP_ENABLED: "true"
74+
KC_PROXY: edge
75+
KC_PROXY_HEADERS: xforwarded
76+
KC_HOSTNAME_STRICT: "false"
77+
KC_HOSTNAME_STRICT_HTTPS: "false"
78+
KC_HOSTNAME: ${KEYCLOAK_FQDN}
79+
KC_FRONTEND_URL: https://${KEYCLOAK_FQDN}
80+
KC_HTTP_PORT: 8080
81+
networks:
82+
- codetogethernet
83+
healthcheck:
84+
test: ["CMD-SHELL", "echo > /dev/tcp/localhost/8080 || exit 1"]
85+
interval: 10s
86+
timeout: 5s
87+
retries: 5
88+
start_period: 30s
89+
90+
volumes:
91+
mysql_data:
92+
93+
networks:
94+
codetogethernet:
95+
driver: bridge

‎compose/nginx/ssl/nginx-with-keycloak.conf.template‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
### To use this file rename it to nginx.conf.template so it is picked up by the compose.yml file.
2+
events {
3+
worker_connections 1024;
4+
}
5+
6+
http {
7+
include mime.types;
8+
default_type application/octet-stream;
9+
sendfile on;
10+
keepalive_timeout 65;
11+
server {
12+
listen 443 ssl http2;
13+
server_name ${COLLAB_FQDN};
14+
proxy_buffer_size 128k;
15+
proxy_buffers 4 256k;
16+
ssl_certificate /etc/nginx/ssl/${SSL_COLLAB_CERT};
17+
ssl_certificate_key /etc/nginx/ssl/${SSL_COLLAB_KEY};
18+
ssl_dhparam /etc/nginx/ssl/${DHPARAM_PEM};
19+
ssl_prefer_server_ciphers on;
20+
ssl_protocols TLSv1.2;
21+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
22+
location / {
23+
# Similar proxy logic for headers
24+
set $realIP $remote_addr;
25+
set $forwardTo $proxy_add_x_forwarded_for;
26+
set $reqHost $http_host;
27+
if ($http_x_real_ip != '') {
28+
set $realIP $http_x_real_ip;
29+
}
30+
if ($http_x_forwarded_for != '') {
31+
set $forwardTo $http_x_forwarded_for;
32+
}
33+
add_header C-Real-IP $realIP;
34+
add_header C-Forwarded-For $forwardTo;
35+
add_header C-Request-Host $reqHost;
36+
proxy_set_header X-Real-IP $realIP;
37+
proxy_set_header X-Forwarded-For $forwardTo;
38+
proxy_set_header Host $reqHost;
39+
proxy_set_header X-NginX-Proxy true;
40+
proxy_http_version 1.1;
41+
proxy_redirect off;
42+
proxy_pass http://codetogether-collab:1080;
43+
proxy_set_header Upgrade $http_upgrade;
44+
proxy_set_header Connection "upgrade";
45+
proxy_read_timeout 360;
46+
proxy_connect_timeout 360;
47+
proxy_send_timeout 360;
48+
}
49+
}
50+
server {
51+
server_name ${INTEL_FQDN};
52+
listen 443 ssl http2;
53+
54+
# configure proxy buffer sizes
55+
proxy_buffer_size 128k;
56+
proxy_buffers 4 256k;
57+
58+
# setup the SSL certificate
59+
ssl_certificate /etc/nginx/ssl/${SSL_INTEL_CERT};
60+
ssl_certificate_key /etc/nginx/ssl/${SSL_INTEL_KEY};
61+
ssl_dhparam /etc/nginx/ssl/${DHPARAM_PEM};
62+
ssl_prefer_server_ciphers on;
63+
ssl_protocols TLSv1.2;
64+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
65+
66+
# create the passthrough to the CodeTogether Intel container
67+
location / {
68+
69+
# set passthru parameters for the CodeTogether Intel container
70+
set $realIP $remote_addr;
71+
set $forwardTo $proxy_add_x_forwarded_for;
72+
set $reqHost $http_host;
73+
client_max_body_size 32M;
74+
if ($http_x_real_ip != '') {
75+
set $realIP $http_x_real_ip;
76+
}
77+
if ($http_x_forwarded_for != '') {
78+
set $forwardTo $http_x_forwarded_for;
79+
}
80+
proxy_set_header X-Real-IP $realIP;
81+
proxy_set_header X-Forwarded-For $forwardTo;
82+
proxy_set_header Host $reqHost;
83+
84+
# setup the backend to service the HQ requests
85+
proxy_pass http://codetogether-intel:1080;
86+
proxy_set_header X-NginX-Proxy true;
87+
proxy_http_version 1.1;
88+
proxy_redirect off;
89+
proxy_set_header Upgrade $http_upgrade;
90+
proxy_set_header Connection "upgrade";
91+
proxy_read_timeout 360;
92+
proxy_connect_timeout 360;
93+
proxy_send_timeout 360;
94+
}
95+
}
96+
server {
97+
server_name ${KEYCLOAK_FQDN};
98+
listen 443 ssl http2;
99+
100+
# configure proxy buffer sizes
101+
proxy_buffer_size 128k;
102+
proxy_buffers 4 256k;
103+
104+
# setup the SSL certificate
105+
ssl_certificate /etc/nginx/ssl/${SSL_KEYCLOAK_CERT};
106+
ssl_certificate_key /etc/nginx/ssl/${SSL_KEYCLOAK_KEY};
107+
# ssl_dhparam /etc/nginx/ssl/${DHPARAM_PEM};
108+
ssl_prefer_server_ciphers on;
109+
ssl_protocols TLSv1.2;
110+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
111+
112+
# create the passthrough to the CodeTogether Intel container
113+
location / {
114+
115+
# set passthru parameters for the CodeTogether Intel container
116+
set $realIP $remote_addr;
117+
set $forwardTo $proxy_add_x_forwarded_for;
118+
set $reqHost $http_host;
119+
client_max_body_size 32M;
120+
if ($http_x_real_ip != '') {
121+
set $realIP $http_x_real_ip;
122+
}
123+
if ($http_x_forwarded_for != '') {
124+
set $forwardTo $http_x_forwarded_for;
125+
}
126+
proxy_set_header X-Real-IP $realIP;
127+
proxy_set_header X-Forwarded-For $forwardTo;
128+
proxy_set_header Host $reqHost;
129+
proxy_set_header X-Forwarded-Proto https;
130+
131+
# setup the backend to service the HQ requests
132+
proxy_pass http://codetogether-keycloak:8080;
133+
proxy_set_header X-NginX-Proxy true;
134+
proxy_http_version 1.1;
135+
proxy_redirect off;
136+
proxy_set_header Upgrade $http_upgrade;
137+
proxy_set_header Connection "upgrade";
138+
proxy_read_timeout 360;
139+
proxy_connect_timeout 360;
140+
proxy_send_timeout 360;
141+
}
142+
}
143+
}

0 commit comments

Comments
 (0)