Skip to content

Commit c9a0357

Browse files
sradzhabovsradzhabov
committed
Docker setup to run localy keycloak, postgress and minio
1 parent aa1ca73 commit c9a0357

File tree

5 files changed

+229
-0
lines changed

5 files changed

+229
-0
lines changed

‎keycloak-minio-docker/README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Here is the polished and spell-checked version of your markdown text:
2+
3+
## Setup
4+
5+
The **Keycloak** container must be running before the **MinIO** container starts up. It takes a few minutes for **Keycloak** and **Postgres** to fully bootstrap.
6+
7+
The file `minio-realm-config.json` is imported at boot and creates the following configuration:
8+
9+
* Realm: `minio_realm`
10+
* Realm Role: `readonly`
11+
* OpenID Client: `minio-client`
12+
* Mapper for `minio-client` mapping the user's **Realm Role** to the token attribute `"policy"`.
13+
* Client User: `testuser` with the assigned role `readonly`.
14+
15+
-----
16+
17+
## Credentials
18+
19+
**MinIO** admin credentials, along with the credentials for **Keycloak** and **Postgres**, are specified in the `docker-compose.yaml` file and `init.env`.
20+
21+
The credentials for the **test user** are specified within the `minio-realm-config.json` file.
22+
23+
-----
24+
25+
## Start
26+
27+
Initialize environment variables:
28+
29+
```bash
30+
source init.env
31+
```
32+
33+
Start the **Keycloak** and **Postgres** containers:
34+
35+
```bash
36+
docker compose -f keycloak.yaml up
37+
```
38+
39+
Once **Keycloak** is running and available, start **MinIO**:
40+
41+
```bash
42+
docker compose -f minio.yaml up
43+
```

‎keycloak-minio-docker/init.env‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
export KEYCLOAK_USER=admin
2+
export KEYCLOAK_PASSWORD=admin
3+
export POSTGRES_DB=keycloakdb
4+
export POSTGRES_USER=psuser
5+
export POSTGRES_PASSWORD=pspassword

‎keycloak-minio-docker/keycloak.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
services:
2+
postgres-db:
3+
image: postgres:16-alpine
4+
volumes:
5+
- postgres_data:/var/lib/postgresql/data
6+
environment:
7+
POSTGRES_DB: ${POSTGRES_DB}
8+
POSTGRES_USER: ${POSTGRES_USER}
9+
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
10+
networks:
11+
- keycloak-network
12+
13+
keycloak:
14+
container_name: keycloak_app
15+
image: quay.io/keycloak/keycloak:latest
16+
user: root
17+
restart: always
18+
ports:
19+
- "8080:8080"
20+
environment:
21+
KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_USER}
22+
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_PASSWORD}
23+
KC_HTTP_ENABLED: 'true'
24+
KC_HOSTNAME_STRICT_HTTPS: false
25+
KC_HOSTNAME: keycloak
26+
KEYCLOAK_IMPORT: /opt/keycloak/data/import/realm-config.json
27+
KC_DB: postgres
28+
KC_DB_URL: jdbc:postgresql://postgres-db/${POSTGRES_DB}
29+
KC_DB_USERNAME: ${POSTGRES_USER}
30+
KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
31+
depends_on:
32+
- postgres-db
33+
networks:
34+
- keycloak-network
35+
command: ["start", "--import-realm"]
36+
volumes:
37+
- ./minio-realm-config.json:/opt/keycloak/data/import/minio-realm-config.json
38+
- keycloak-data:/opt/keycloak/data
39+
40+
volumes:
41+
postgres_data:
42+
driver: local
43+
keycloak-data:
44+
45+
networks:
46+
keycloak-network:
47+
name: keycloak-network
48+
driver: bridge
49+

‎keycloak-minio-docker/minio-realm-config.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"realm": "minio_realm",
3+
"enabled": true,
4+
"users": [
5+
{
6+
"username": "testuser",
7+
"email": "[email protected]",
8+
"firstName": "Sarah",
9+
"lastName": "Connor",
10+
"enabled": true,
11+
"emailVerified": true,
12+
"credentials": [
13+
{
14+
"type": "password",
15+
"value": "password",
16+
"temporary": false
17+
}
18+
],
19+
"realmRoles": [
20+
"readonly"
21+
]
22+
}
23+
],
24+
"clients": [
25+
{
26+
"clientId": "minio-client",
27+
"name": "MinIO OIDC Client",
28+
"secret": "nrb2E4DKOL7QmShrtTO1O7RERXeKt6UC",
29+
"enabled": true,
30+
"protocol": "openid-connect",
31+
"clientAuthenticatorType": "client-secret",
32+
"publicClient": false,
33+
"implicitFlowEnabled": false,
34+
"directAccessGrantsEnabled": false,
35+
"serviceAccountsEnabled": false,
36+
"standardFlowEnabled": true,
37+
"rootUrl": "http://127.0.0.1:9001",
38+
"redirectUris": [
39+
"http://127.0.0.1:9001/oauth_callback"
40+
],
41+
"defaultClientScopes": [
42+
"openid",
43+
"profile",
44+
"email"
45+
],
46+
"optionalClientScopes": [
47+
"offline_access"
48+
],
49+
"protocolMappers": [
50+
{
51+
"name": "realm-role-mapper",
52+
"protocol": "openid-connect",
53+
"protocolMapper": "oidc-usermodel-realm-role-mapper",
54+
"consentRequired": false,
55+
"config": {
56+
"introspection.token.claim": "true",
57+
"multivalued": "true",
58+
"userinfo.token.claim": "true",
59+
"id.token.claim": "true",
60+
"lightweight.claim": "false",
61+
"access.token.claim": "true",
62+
"claim.name": "policy",
63+
"jsonType.label": "String"
64+
}
65+
},
66+
{
67+
"name": "security-admin-audience-mapper",
68+
"protocol": "openid-connect",
69+
"protocolMapper": "oidc-audience-mapper",
70+
"config": {
71+
"included.client.audience": "security-admin-console",
72+
"id.token.claim": "true",
73+
"access.token.claim": "true"
74+
}
75+
}
76+
]
77+
}
78+
],
79+
"roles": {
80+
"realm": [
81+
{
82+
"name": "readonly",
83+
"description": "This role provides read only access to all buckets",
84+
"composite": false,
85+
"clientRole": false,
86+
"attributes": {}
87+
}
88+
]
89+
}
90+
}

‎keycloak-minio-docker/minio.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
services:
2+
# ----------------------------------
3+
# MinIO Object Storage
4+
# ----------------------------------
5+
minio:
6+
image: quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z
7+
container_name: minio
8+
environment:
9+
MINIO_ROOT_USER: minioadmin
10+
MINIO_ROOT_PASSWORD: minioadmin
11+
12+
# OIDC Configuration (uses the service name 'keycloak' and the standard port)
13+
MINIO_IDENTITY_OPENID_CONFIG_URL: http://keycloak:8080/realms/minio_realm/.well-known/openid-configuration
14+
MINIO_IDENTITY_OPENID_CLIENT_ID: minio-client
15+
MINIO_IDENTITY_OPENID_CLIENT_SECRET: nrb2E4DKOL7QmShrtTO1O7RERXeKt6UC
16+
MINIO_IDENTITY_OPENID_CLAIM_NAME: "policy"
17+
MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email
18+
MINIO_BROWSER_REDIRECT_URL: http://127.0.0.1:9001
19+
MINIO_IDENTITY_OPENID_REDIRECT_URI: http://127.0.0.1:9001/oauth_callback
20+
MINIO_IDENTITY_OPENID_DISPLAY_NAME: "Login with SSO"
21+
22+
23+
command: server /data --console-address ":9001"
24+
ports:
25+
- "9000:9000"
26+
- "9001:9001"
27+
volumes:
28+
- minio-data:/data
29+
networks:
30+
- keycloak-network
31+
restart: unless-stopped
32+
33+
volumes:
34+
minio-data:
35+
keycloak-data:
36+
37+
38+
networks:
39+
keycloak-network:
40+
name: keycloak-network
41+
external: true
42+

0 commit comments

Comments
 (0)