Update Keycloak image version to 26.4

.drone.yml

@@ -1,41 +0,0 @@
----
-kind: pipeline
-name: deploy to swarm-test.autonomic.zone
-steps:
-  - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
-    settings:
-      host: swarm-test.autonomic.zone
-      stack: keycloak
-      networks:
-       - proxy
-      generate_secrets: true
-      purge: true
-      deploy_key:
-        from_secret: drone_ssh_swarm_test
-    environment:
-      DOMAIN: keycloak.swarm-test.autonomic.zone
-      STACK_NAME: keycloak
-      LETS_ENCRYPT_ENV: production
-      SECRET_ADMIN_PASSWORD_VERSION: v1
-      SECRET_DB_PASSWORD_VERSION: v1
-      SECRET_DB_ROOT_PASSWORD_VERSION: v1
-trigger:
-  branch:
-    - master
----
-kind: pipeline
-name: generate recipe catalogue
-steps:
-  - name: release a new version
-    image: plugins/downstream
-    settings:
-      server: https://build.coopcloud.tech
-      token:
-        from_secret: drone_abra-bot_token
-      fork: true
-      repositories:
-        - toolshed/auto-recipes-catalogue-json
-
-trigger:
-  event: tag

.env.sample

@@ -1,18 +0,0 @@
-TYPE=keycloak
-
-DOMAIN=keycloak.example.com
-## Domain aliases
-#EXTRA_DOMAINS=', `www.keycloak.example.com`'
-LETS_ENCRYPT_ENV=production
-
-ADMIN_USERNAME=admin
-WELCOME_THEME=keycloak
-
-COMPOSE_FILE="compose.yml"
-
-SECRET_DB_ROOT_PASSWORD_VERSION=v1
-SECRET_DB_PASSWORD_VERSION=v1
-SECRET_ADMIN_PASSWORD_VERSION=v1
-
-# Enable persistent theme volume, if you want to apply a custom theme
-#COMPOSE_FILE="$COMPOSE_FILE:compose.theme.yml"

.gitignore

@@ -0,0 +1 @@
+.env

README.md

@@ -1,70 +1,36 @@
-# keycloak
+# Keycloak
 
-[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/keycloak/status.svg)](https://drone.autonomic.zone/coop-cloud/keycloak)
+Wiki Cafe's configuration for a Keycloak deployment. Originally slimmed down from an `abra` [recipe](https://git.coopcloud.tech/coop-cloud/keycloak) by [Co-op Cloud](https://coopcloud.tech/).
 
-[Keycloak](https://www.keycloak.org) + Coöp Cloud.
+## Extensions
 
-<!-- metadata -->
-* **Category**: Apps
-* **Status**: 2, beta
-* **Image**: [`jboss/keycloak`](https://hub.docker.com/r/jboss/keycloak), 4, upstream
-* **Healthcheck**: Yes
-* **Backups**: ?
-* **Email**: 1
-* **Tests**: 2
-* **SSO**: N/A
-<!-- endmetadata -->
+This stack includes the following extensions:
 
-## Basic usage
+- (keycloak-events)[https://github.com/p2-inc/keycloak-events]
+- (keycloak-restrict-client-auth)[https://github.com/sventorben/keycloak-restrict-client-auth]
 
-1. Set up Docker Swarm and [`abra`][abra]
-2. Deploy [`coop-cloud/traefik`][cc-traefik]
-3. `abra app new keycloak --secrets` (optionally with `--pass` if you'd like
-   to save secrets in `pass`). Make sure to note the `admin_password` which is needed for initial setup.
-4. `abra app config YOURAPPDOMAIN` - be sure to change `$DOMAIN` to something that resolves to
-   your Docker swarm box
-5. `abra app deploy YOURAPPDOMAIN`
+### Installing extensions
 
-## Replacing the temporary admin user
+To install the extensions, download their JAR files and place them in the `providers` directory. Then, restart the Keycloak container.
 
-When you first deploy Keycloak, you will login in as a temporary admin user with the username "admin" and a random password generated in step 3 above. You need to create a real admin user and delete the temp admin user, because the temp admin user has no 2FA and its password is stored in plain text on the server, which is insecure. Here's how to create the real admin user:
+You can update an extension by simply replacing the old JAR file with the new one.
 
-1. Click "Users" then "Add user"
-2. For "required user actions", I recommend setting "Configure OTP" and "Update Password" to ensure 2FA is enabled.
-3. Set a username, then click "Create"
-5. Go to the "Role Mapping" tab and click "Assign role"
-6. Change the filter from "Filter by clients" to "Filter by realm roles". Select the box for "role_admin" and click "Assign". This makes the user become an admin.
-7. Go to the "Credentials" tab. Click "Set password". Set it to something random and save it for the next step. Leave "Temporary" enabled so the user has to change the password on first login.
-8. If this is an admin account for you, then log out and back in as the new admin user and complete the password change and OTP steps. If this is an admin account for someone else, securely send the initial username and password to the user. They must complete the password change and OTP setup when they first log in.
+## Deploying the app with Docker Swarm
 
-Once at least one real admin user is set up, you should then delete the temporary "admin" user.
-
-## How do I setup a custom theme?
-
-Check [this approach](https://git.autonomic.zone/ruangrupa/login.lumbung.space).
-
-## How do I create another admin user?
-
-- Under the `Master` realm > `Users` > `Add user`
-- Create the user and set a temporary password
-- Under the `Role Mappings` tab, move `admin` from `Available Roles` into `Assigned Roles`
-
-## What do I do if I lost my admin account credentials?
-
-You can create a new admin account like this:
+Set the environment variables from the .env file during the shell session.
 
 ```
-abra app run <domain> app -- bash -c '/opt/keycloak/bin/kc.sh bootstrap-admin user --db-password $(cat /run/secrets/db_password)'
+set -a && source .env && set +a
 ```
 
-Make sure to delete the temp-admin user after you finish recovering.
+Set the secrets.
 
-## How do I configure Keycloak login for..
+```
+printf "SECRET_HERE" | docker secret create SECRET_NAME -
+```
 
-- [Nextcloud][nextcloud]
-- [Peertube][peertube]
+Deploy using the `-c` flag to specify one or multiple compose files.
 
-[nextcloud]: https://git.coopcloud.tech/coop-cloud/nextcloud#how-do-i-integrate-with-keycloak-sso
-[peertube]: https://git.coopcloud.tech/coop-cloud/peertube#plugins
-[abra]: https://git.autonomic.zone/autonomic-cooperative/abra
-[cc-traefik]: https://git.autonomic.zone/coop-cloud/traefik
+```
+docker stack deploy keycloak --detach=true -c compose.yaml
+```

compose.theme.yml

@@ -1,7 +0,0 @@
-services:
-  app:
-    volumes:
-      - "themes:/opt/keycloak/themes"
-
-volumes:
-  themes:

compose.yaml

@@ -0,0 +1,90 @@
+services:
+  app:
+    image: "keycloak/keycloak:26.4"
+    entrypoint: >
+      bash -c "KC_BOOTSTRAP_ADMIN_PASSWORD=\"$$(cat /run/secrets/admin_password)\" KC_DB_PASSWORD=\"$$(cat /run/secrets/db_password)\" /opt/keycloak/bin/kc.sh start"
+    networks:
+      - proxy
+      - internal
+    secrets:
+      - admin_password
+      - db_password
+    environment:
+      - KC_DB=mariadb
+      - KC_DB_URL_DATABASE=keycloak
+      - KC_DB_URL_HOST=db
+      - KC_HOSTNAME=https://${DOMAIN}
+      - KC_PROXY_HEADERS=xforwarded
+      - KC_BOOTSTRAP_ADMIN_USERNAME=${ADMIN_USERNAME}
+      - KEYCLOAK_WELCOME_THEME=${WELCOME_THEME}
+      - KC_FEATURES
+      - KC_HTTP_ENABLED=true
+    # healthcheck:
+    # https://www.keycloak.org/server/health
+    # Use external health checks
+    volumes:
+      - "themes:/opt/keycloak/themes"
+      - "providers:/opt/keycloak/providers"
+    depends_on:
+      - mariadb
+    deploy:
+      update_config:
+        failure_action: rollback
+        order: start-first
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
+        - "traefik.http.routers.keycloak.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
+        - "traefik.http.routers.keycloak.entrypoints=web-secure"
+        - "traefik.http.routers.keycloak.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.keycloak.middlewares=keycloak-redirect"
+        - "traefik.http.middlewares.keycloak-redirect.headers.SSLForceHost=true"
+        - "traefik.http.middlewares.keycloak-redirect.headers.SSLHost=${DOMAIN}"
+        - "caddy=${DOMAIN}"
+        - "caddy.reverse_proxy={{upstreams 8080}}"
+        - "caddy.tls.on_demand="
+
+  db:
+    image: "mariadb:10.11"
+    environment:
+      - MYSQL_DATABASE=keycloak
+      - MYSQL_USER=keycloak
+      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
+      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
+    secrets:
+      - db_password
+      - db_root_password
+    volumes:
+      - "mariadb:/var/lib/mysql"
+    networks:
+      - internal
+    deploy:
+      labels:
+        backupbot.backup: "true"
+        backupbot.backup.path: "/tmp/dump.sql.gz"
+        backupbot.backup.post-hook: "rm -f /tmp/dump.sql.gz"
+        backupbot.backup.pre-hook: "sh -c 'mysqldump -u root -p\"$$(cat /run/secrets/db_root_password)\" keycloak | gzip > /tmp/dump.sql.gz'"
+        backupbot.restore.pre-hook: "sh -c 'cd /tmp && gzip -d dump.sql.gz'" 
+        backupbot.restore: "true"
+        backupbot.restore.post-hook: "sh -c 'mysql -u root -p\"$$(cat /run/secrets/db_root_password)\" keycloak < /tmp/dump.sql && rm -f /tmp/dump.sql'"
+
+networks:
+  internal:
+  proxy:
+    external: true
+
+secrets:
+  admin_password:
+    name: keycloak_admin_password
+    external: true
+  db_password:
+    name: keycloak_db_password
+    external: true
+  db_root_password:
+    name: keycloak_db_root_password
+    external: true
+
+volumes:
+  mariadb:
+  themes:
+  providers:

compose.yml

@@ -1,93 +0,0 @@
-services:
-  app:
-    image: "keycloak/keycloak:26.6.4"
-    entrypoint: >
-      bash -c "KEYCLOAK_ADMIN_PASSWORD=\"$$(cat /run/secrets/admin_password)\" KC_DB_PASSWORD=\"$$(cat /run/secrets/db_password)\" /opt/keycloak/bin/kc.sh start"
-    networks:
-      - proxy
-      - internal
-    secrets:
-      - admin_password
-      - db_password
-    environment:
-      - KC_DB=mariadb
-      - KC_DB_URL_DATABASE=keycloak
-      - KC_DB_URL_HOST=db
-      - KC_HOSTNAME=https://${DOMAIN}
-      - KC_PROXY=edge
-      - KC_SPI_CONNECTIONS_JPA_LEGACY_MIGRATION_STRATEGY=update
-      - KEYCLOAK_ADMIN=${ADMIN_USERNAME}
-      - KEYCLOAK_WELCOME_THEME=${WELCOME_THEME}
-      - KC_PROXY_HEADERS=xforwarded
-      - KC_HTTP_ENABLED=true
-    # NOTE(3wc): disabled due to missing curl binary, see
-    #   https://git.coopcloud.tech/coop-cloud/keycloak/issues/15
-    # healthcheck:
-    #   test: ["CMD", "curl", "-f", "http://localhost:8080"]
-    #   interval: 30s
-    #   timeout: 10s
-    #   retries: 10
-    #   start_period: 1m
-    volumes:
-      - "providers:/opt/keycloak/providers"
-    depends_on:
-      - mariadb
-    deploy:
-      update_config:
-        failure_action: rollback
-        order: start-first
-      labels:
-        - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8080"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
-        - "caddy=${DOMAIN}"
-        - "caddy.reverse_proxy={{upstreams 8080}}"
-        - "caddy.tls.on_demand="
-        - "coop-cloud.${STACK_NAME}.version=10.8.1+26.6.4"
-
-  db:
-    image: "mariadb:12.3"
-    environment:
-      - MYSQL_DATABASE=keycloak
-      - MYSQL_USER=keycloak
-      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
-      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
-    secrets:
-      - db_password
-      - db_root_password
-    volumes:
-      - "mariadb:/var/lib/mysql"
-    networks:
-      - internal
-    deploy:
-      labels:
-        backupbot.backup: "true"
-        backupbot.backup.volumes.mariadb.path: "dump.sql.gz"
-        backupbot.backup.pre-hook: "sh -c 'mariadb-dump -u root -p\"$$(cat /run/secrets/db_root_password)\" keycloak | gzip > /var/lib/mysql/dump.sql.gz'"
-        backupbot.backup.post-hook: "rm -f /var/lib/mysql/dump.sql.gz"
-        backupbot.restore.post-hook: "sh -c 'gzip -d /var/lib/mysql/dump.sql.gz && mariadb -u root -p\"$$(cat /run/secrets/db_root_password)\" keycloak < /var/lib/mysql/dump.sql && rm -f /var/lib/mysql/dump.sql'"
-
-networks:
-  internal:
-  proxy:
-    external: true
-
-secrets:
-  admin_password:
-    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
-    external: true
-  db_password:
-    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
-    external: true
-  db_root_password:
-    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
-    external: true
-
-volumes:
-  mariadb:
-  providers:

release/10.5.0+26.4.0

@@ -1 +0,0 @@
-See here for possible breaking changes: https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-4-0

release/4.0.0+16.1.0

@@ -1,12 +0,0 @@
-This major release comes with a blog post about a CVE:
-
-    https://www.keycloak.org/2021/12/cve.html
-
-Not all versions are affected but they're suggesting that people upgrade soon.
-
-As per usual, this upgrade didn't go too smoothly and I ended up having to
-undeploy and deploy the new versions. The healtcheck kept failing on the new
-instance when trying to deploy alongside the existing old version. Idk, some
-docker weirdness.
-
-No app data errors discovered after upgrade.

release/5.0.0+20.0.1

@@ -1,9 +0,0 @@
-You'll need to remove `/auth/` from your app SSO URLs, e.g.
-
-    https://foo.example.com/auth/realms/foo/protocol/openid-connect/auth
-
-Would become:
-
-    https://foo.example.com/realms/foo/protocol/openid-connect/auth
-
--- decentral1se @ Autonomic

release/6.0.0+21.0.2

@@ -1,2 +0,0 @@
-Healthchecks are disabled, see
-https://git.coopcloud.tech/coop-cloud/keycloak/issues/15

release/7.2.0+22.0.5

@@ -1,5 +0,0 @@
-A persistent volume for themes is now optional, and not enabled by default.
-
-If you are using a custom theme, consult the recipe `.env.sample` to see the new
-variables you need to add. You can use `abra app check ...` to verify that
-they've been added correctly.

renovate.json

@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:base"
-  ]
-}