.env.docker.example

# OBP Keycloak Provider — Docker environment example
#
# Use this as a starting point for running the published Docker image:
#
#   docker run \
#     --env-file .env \
#     -p 7787:8080 -p 8443:8443 -p 9000:9000 \
#     tesobe/obp-keycloak:latest
#
# Or reference it from docker-compose:
#
#   services:
#     keycloak:
#       image: tesobe/obp-keycloak:latest
#       env_file: .env.docker.example
#
# All sensitive values must be overridden — do NOT use these defaults in production.

# =============================================================================
# KEYCLOAK ADMIN
# =============================================================================
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=change_me

# =============================================================================
# KEYCLOAK INTERNAL DATABASE
# Keycloak needs its own PostgreSQL database for realm data, clients, tokens.
# =============================================================================
KC_DB_URL=jdbc:postgresql://keycloak-postgres:5432/keycloak
KC_DB_USERNAME=keycloak
KC_DB_PASSWORD=change_me

# =============================================================================
# OBP API — all user authentication delegates to these endpoints
#
# Flow inside the container:
#   POST /obp/v6.0.0/my/logins/direct          → admin token
#   GET  /obp/v6.0.0/users/provider/{P}/username/{U} → user lookup
#   POST /obp/v6.0.0/users/verify-credentials  → password check
#   GET  /obp/v6.0.0/users/user-id/{ID}        → post-auth lookup
#
# Required roles on OBP_API_USERNAME:
#   CanGetAnyUser, CanVerifyUserCredentials, CanGetOidcClient
# =============================================================================

# If OBP runs on the same host machine use host.docker.internal, not localhost
OBP_API_URL=http://host.docker.internal:8080

OBP_API_USERNAME=obp_admin_user
OBP_API_PASSWORD=change_me

# Consumer key registered in OBP for Direct Login
OBP_API_CONSUMER_KEY=your_consumer_key

# MANDATORY: only users whose OBP `provider` field exactly matches this value
# will be authenticated through Keycloak.
OBP_AUTHUSER_PROVIDER=http://127.0.0.1:8080

# =============================================================================
# KEYCLOAK RUNTIME
# =============================================================================
KC_HOSTNAME_STRICT=false
KC_HOSTNAME_STRICT_HTTPS=false
KC_HTTP_ENABLED=true
KC_HEALTH_ENABLED=true
KC_METRICS_ENABLED=true
KC_FEATURES=token-exchange

# =============================================================================
# THEME CUSTOMISATION (optional)
# Override the "Forgot Password?" link. Leave empty for Keycloak's built-in flow.
# =============================================================================
FORGOT_PASSWORD_URL=