# Keycloak + SCIM plugin integration test environment.
#
# Starts Keycloak (with mitodl/keycloak-scim plugin), CCAG gateway (mock-bedrock),
# and Postgres. Used by tests/e2e/test_scim_oidc.sh for full-loop testing.
#
# Usage:
#   # Build the mock-bedrock gateway binary first:
#   cargo build --bin ccag-server --features mock-bedrock
#
#   docker compose -f tests/e2e/keycloak-scim/docker-compose.yml up -d
#   ./tests/e2e/test_scim_oidc.sh
#   docker compose -f tests/e2e/keycloak-scim/docker-compose.yml down -v
#
# NOTE: The gateway runs on the host (not in Docker) to avoid Dockerfile
# complexity with feature flags. Only Keycloak and Postgres run in containers.

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: proxy
      POSTGRES_USER: proxy
      POSTGRES_PASSWORD: testpass
    ports:
      - "5434:5432"
    tmpfs:
      - /var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U proxy -d proxy"]
      interval: 2s
      timeout: 5s
      retries: 10

  keycloak:
    build:
      context: .
      dockerfile: Dockerfile
    command: start-dev --import-realm
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HTTP_PORT: 9090
      KC_HOSTNAME_STRICT: "false"
    ports:
      - "9090:9090"
    volumes:
      - ./realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9090 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: 127.0.0.1\\r\\n\\r\\n' >&3 && head -1 <&3 | grep -q 200"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 30s
