581d6a0929
Go-live: - Switch keycloak from start-dev to start --import-realm (production mode with auto-build at boot, no Dockerfile needed yet). - Set KC_HOSTNAME=https://auth.e-cosplay.fr and KC_PROXY_HEADERS= xforwarded so Keycloak emits correct issuer URLs and trusts Caddy's X-Forwarded-* headers. - Replace deprecated KEYCLOAK_ADMIN env vars with KC_BOOTSTRAP_ADMIN_*. - Bind the public port to 127.0.0.1 only (Caddy is colocated). - Add a Keycloak healthcheck against /health/ready on the management port (9000) using bash /dev/tcp; init container now waits on service_healthy instead of service_started. Architecture: - New realms/ecosplay-realm.json mounted into /opt/keycloak/data/import and imported on first boot. Defines the dedicated 'ecosplay' realm (separate from master) with French i18n, brute-force protection, strong password policy, SES SMTP, and an OIDC client 'ecosplay-web' pointing at e-cosplay.fr (confidential + PKCE S256). Theme coverage: - themes/ecosplay/account: PatternFly v5 overlay (parent=keycloak.v2) bringing the neo-brutalist colors, thick borders, italic uppercase typography, and offset hard shadows to the user account console. - themes/ecosplay/email: branded HTML wrapper template (table layout with inline styles for email-client safety) plus a matching plain text wrapper. All Keycloak emails now ship with the E-Cosplay identity without needing per-template overrides. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
86 lines
2.5 KiB
JSON
86 lines
2.5 KiB
JSON
{
|
|
"realm": "ecosplay",
|
|
"displayName": "E-Cosplay",
|
|
"displayNameHtml": "<span style=\"font-weight:900;text-transform:uppercase;font-style:italic;\">E-Cosplay</span>",
|
|
"enabled": true,
|
|
|
|
"loginTheme": "ecosplay",
|
|
"accountTheme": "ecosplay",
|
|
"emailTheme": "ecosplay",
|
|
"adminTheme": "keycloak.v2",
|
|
|
|
"internationalizationEnabled": true,
|
|
"supportedLocales": ["fr"],
|
|
"defaultLocale": "fr",
|
|
|
|
"registrationAllowed": true,
|
|
"registrationEmailAsUsername": true,
|
|
"rememberMe": true,
|
|
"verifyEmail": true,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"resetPasswordAllowed": true,
|
|
"editUsernameAllowed": false,
|
|
|
|
"bruteForceProtected": true,
|
|
"permanentLockout": false,
|
|
"maxFailureWaitSeconds": 900,
|
|
"minimumQuickLoginWaitSeconds": 60,
|
|
"waitIncrementSeconds": 60,
|
|
"quickLoginCheckMilliSeconds": 1000,
|
|
"maxDeltaTimeSeconds": 43200,
|
|
"failureFactor": 5,
|
|
|
|
"passwordPolicy": "length(10) and specialChars(1) and digits(1) and upperCase(1) and lowerCase(1) and notUsername(undefined) and notEmail(undefined)",
|
|
|
|
"accessTokenLifespan": 300,
|
|
"accessTokenLifespanForImplicitFlow": 900,
|
|
"ssoSessionIdleTimeout": 1800,
|
|
"ssoSessionMaxLifespan": 36000,
|
|
"offlineSessionIdleTimeout": 2592000,
|
|
"actionTokenGeneratedByUserLifespan": 900,
|
|
|
|
"smtpServer": {
|
|
"host": "email-smtp.eu-west-3.amazonaws.com",
|
|
"port": "587",
|
|
"from": "auth@e-cosplay.fr",
|
|
"fromDisplayName": "E-Cosplay",
|
|
"replyTo": "noreply@e-cosplay.fr",
|
|
"envelopeFrom": "auth@e-cosplay.fr",
|
|
"auth": "true",
|
|
"starttls": "true",
|
|
"ssl": "false",
|
|
"user": "AKIAWTT2T22CWBRBBDYN",
|
|
"password": "BBdgb6KxRQ8mNcpWFJsZCJxbSGNdgLhKFiITMErfBlQP"
|
|
},
|
|
|
|
"clients": [
|
|
{
|
|
"clientId": "ecosplay-web",
|
|
"name": "E-Cosplay Web",
|
|
"description": "Application web principale e-cosplay.fr",
|
|
"enabled": true,
|
|
"publicClient": false,
|
|
"secret": "change-me-in-admin-console",
|
|
"redirectUris": [
|
|
"https://www.e-cosplay.fr/*",
|
|
"https://e-cosplay.fr/*"
|
|
],
|
|
"webOrigins": [
|
|
"https://www.e-cosplay.fr",
|
|
"https://e-cosplay.fr"
|
|
],
|
|
"protocol": "openid-connect",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"attributes": {
|
|
"post.logout.redirect.uris": "https://www.e-cosplay.fr/*##https://e-cosplay.fr/*",
|
|
"pkce.code.challenge.method": "S256"
|
|
}
|
|
}
|
|
]
|
|
}
|