version: '3.8'

services:
  postgres-keycloak-db:
    image: postgres:15 # Or your preferred version
    container_name: postgres-keycloak-db
    volumes:
      - keycloak_db_data:/var/lib/postgresql/data
      # Optional: Mount a SQL script to initialize the DB if needed by Keycloak (usually not necessary as Keycloak handles schema)
      # - ./init-keycloak-db.sql:/docker-entrypoint-initdb.d/init.sql
    environment:
      POSTGRES_DB: keycloak_db # Database name for Keycloak
      POSTGRES_USER: keycloak_user
      POSTGRES_PASSWORD: root # Change this!
    ports:
      - "5433:5432" # Expose PostgreSQL on a different host port if 5432 is in use
    networks:
      - my_app_network
    restart: unless-stopped

  keycloak:
    image: quay.io/keycloak/keycloak:latest # Or a specific version e.g., 24.0.4
    container_name: keycloak_server
    command: start-dev # For development. For production, use 'start' and configure properly.
    environment:
      KC_DB: postgres
      KC_DB_URL_HOST: postgres-keycloak-db # Service name of the PostgreSQL container
      KC_DB_URL_DATABASE: keycloak_db
      KC_DB_USERNAME: keycloak_user
      KC_DB_PASSWORD: root # Must match PostgreSQL password
      KC_DB_SCHEMA: public
      KEYCLOAK_ADMIN: admin # Initial Keycloak admin username
      KEYCLOAK_ADMIN_PASSWORD: admin # Change this!
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT_HTTPS: "false"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME: "voidscrypt.com"  # Set to your server's IP
      KC_HTTP_PORT: "7080"
      # Optional: For importing realms on startup (see section below)
      # KC_HOSTNAME: localhost # Important for NextAuth/frontend redirects if not behind a reverse proxy
    ports:
      - "7080:7080" # Keycloak HTTP port
      # - "8443:8443" # Keycloak HTTPS port (if you configure TLS)
    depends_on:
      - postgres-keycloak-db
    networks:
      - my_app_network
    # Optional: Mount a directory for realm exports/imports
    # volumes:
    #   - ./keycloak-realms:/opt/keycloak/data/import
    restart: unless-stopped

volumes:
  keycloak_db_data:

networks:
  my_app_network:
    driver: bridge
