epugh commented on code in PR #192:
URL: https://github.com/apache/solr-mcp/pull/192#discussion_r4027198673
##########
compose.yaml:
##########
@@ -57,6 +57,42 @@ services:
# Prevent Spring Boot auto-configuration from trying to manage this
service
org.springframework.boot.ignore: "true"
+ #
=============================================================================
+ # Keycloak - the identity provider the http profile authenticates against
+ #
=============================================================================
+ # Gated behind the `http` compose profile so a plain `docker compose up -d`
(STDIO users) does not
+ # start it; the http Spring profile activates it via
spring.docker.compose.profiles.active. The realm is
+ # imported from keycloak/solr-mcp-realm.json, so the clients and —
critically — the audience
+ # protocol mapper exist before the server ever asks for a token.
+ #
+ # The mapper is what makes tokens acceptable here. Keycloak does not honour
the RFC 8707
+ # `resource=` parameter, so without it a token is issued normally and then
rejected by
+ # validateAudienceClaim(true) with a 401. See docs/security/keycloak.md.
+ #
+ # The healthcheck is not decoration: the server resolves the issuer at
startup and fails to boot
+ # if the realm is not yet answering, so Spring Boot must wait for this
container to be healthy
+ # before the application context starts. Keycloak's image ships neither curl
nor wget, hence
+ # bash's /dev/tcp.
+ keycloak:
+ profiles: [ http ]
+ image: quay.io/keycloak/keycloak:26.0
+ ports:
+ - "8180:8080"
+ networks: [ search ]
+ environment:
+ KC_BOOTSTRAP_ADMIN_USERNAME: admin
+ KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+ KC_HEALTH_ENABLED: "true"
+ command: [ "start-dev", "--import-realm" ]
+ volumes:
+ - ./keycloak:/opt/keycloak/data/import:ro
+ healthcheck:
+ test: [ "CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && echo -e 'GET
/health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 &&
cat <&3 | grep -q '\"status\": \"UP\"'" ]
Review Comment:
@adityamparikh can you jsut investigate this? It may be we don't have curl
or wget available in the image? so we do this very interesting thing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
