{
  "module": "keycloak",
  "version": "1",

  "requires": ["postgres-database"],
  "contributes": {
    "postgres-database": {"name": "keycloak"}
  },
  "binds": {"postgres-database": "/var/lib/keycloak/database.json"},
  "secrets": {"postgres-database": "/var/lib/keycloak/database.secret"},

  "capabilities": ["container-runtime"],

  "listens": [
    {"port": 8080, "protocol": "tcp", "from": "mesh",
     "why": "anything the mesh runs that authenticates a person"}
  ],

  "own-secrets": {"admin": "/var/lib/keycloak/admin.secret"},

  "resources": [
    {"id": "state", "type": "directory", "path": "/var/lib/keycloak", "mode": "0700"},

    {"id": "admin-env", "type": "file", "path": "/var/lib/keycloak/admin.env", "mode": "0600",
     "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"},

    {"id": "database-env", "type": "file", "path": "/var/lib/keycloak/database.env", "mode": "0600",
     "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/keycloak\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"},

    {"id": "net", "type": "network", "name": "keycloak"},

    {"id": "server", "type": "container", "name": "keycloak",
     "image": "quay.io/keycloak/keycloak@sha256:ecd43971114b0c764f8a3288dddab73f98cb473daccc4feaffe4dc14adeaf866",
     "network": "keycloak",
     "args": ["start-dev"],
     "env": {"KC_DB": "postgres", "KC_HTTP_ENABLED": "true", "KC_HEALTH_ENABLED": "true"},
     "env-file": ["/var/lib/keycloak/admin.env", "/var/lib/keycloak/database.env"],
     "ports": ["8080:8080"],
     "restart-on": ["admin-env", "database-env"]}
  ]
}