{
  "module": "keycloak",
  "version": "1",

  "requires": ["postgres-database"],
  "contributes": {
    "postgres-database": {"name": "keycloak"}
  },
  "binds": {"postgres-database": "/var/lib/keycloak/database.json"},
  "secrets": {"postgres-database": "/var/lib/keycloak/database.secret"},

  "provides": [{"name": "oidc-client", "scope": "mesh"}],
  "capabilities": ["container-runtime"],

  "listens": [
    {"port": 8080, "protocol": "tcp", "from": "mesh",
     "why": "anything the mesh runs that authenticates a person"}
  ],

  "serves": {
    "oidc-client": {"port": 8080, "realm": "mesh", "scheme": "http"}
  },

  "receives": {"oidc-client": "/var/lib/keycloak/grants/mesh.json"},
  "grants": {"oidc-client": "/var/lib/keycloak/grants"},

  "own-secrets": {"admin": "/var/lib/keycloak/admin.secret"},

  "resources": [
    {"id": "state", "type": "directory", "path": "/var/lib/keycloak", "mode": "0700"},
    {"id": "grants", "type": "directory", "path": "/var/lib/keycloak/grants", "mode": "0700"},

    {"id": "admin-env", "type": "file", "path": "/var/lib/keycloak/admin.env", "mode": "0600",
     "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"},

    {"id": "net", "type": "network", "name": "keycloak"},

    {"id": "server", "type": "container", "name": "keycloak",
     "image": "keycloak@sha256:0000000000000000000000000000000000000000000000000000000000000000",
     "network": "keycloak",
     "args": ["start-dev"],
     "env": {"KC_DB": "postgres", "KC_HTTP_ENABLED": "true", "KC_HEALTH_ENABLED": "true"},
     "env-file": ["/var/lib/keycloak/admin.env"],
     "ports": ["8080:8080"],
     "restart-on": ["admin-env"]},

    {"id": "provisioner", "type": "container", "name": "mesh-provision-keycloak",
     "image": "mesh-provision-keycloak@sha256:0000000000000000000000000000000000000000000000000000000000000000",
     "network": "keycloak",
     "env": {
       "GRANTS": "/var/lib/keycloak/grants",
       "MESH_KEYCLOAK_URL": "http://keycloak:8080",
       "MESH_KEYCLOAK_REALM": "mesh",
       "MESH_KEYCLOAK_ADMIN": "admin",
       "MESH_KEYCLOAK_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
     },
     "volumes": [
       "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro",
       "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro"
     ],
     "restart-on": ["grants", "admin-env"]}
  ]
}