first commit

keycloak-hybrid-x509-spi/Dockerfile.example

@@ -0,0 +1,26 @@
+# Example: adding the hybrid x509 SPI to a custom Keycloak image.
+# Merge these lines into your EXISTING Dockerfile — keep your current base tag,
+# build options (KC_DB, KC_FEATURES, ...), and entrypoint.
+
+FROM quay.io/keycloak/keycloak:26.0 AS builder
+
+COPY target/keycloak-hybrid-x509-spi-1.0.0.jar /opt/keycloak/providers/
+
+# Build-time option: must be set before `kc.sh build` (runtime-only won't work
+# for images started with --optimized). `request` = client cert OPTIONAL.
+ENV KC_HTTPS_CLIENT_AUTH=request
+
+RUN /opt/keycloak/bin/kc.sh build
+
+FROM quay.io/keycloak/keycloak:26.0
+COPY --from=builder /opt/keycloak/ /opt/keycloak/
+
+# Runtime config (usually set via Helm/manifest env instead of baked in):
+#   KC_SPI_X509CERT_LOOKUP_PROVIDER=hybrid
+#   KC_SPI_X509CERT_LOOKUP_HYBRID_SSL_CLIENT_CERT=<your existing header name>
+#   KC_SPI_X509CERT_LOOKUP_HYBRID_TRUST_MODE=log        # then 'enforce' after cycle 3
+#   KC_TRUSTSTORE_PATHS=/opt/keycloak/conf/truststores  # CA bundle (KC 25+)
+#   KC_LOG_LEVEL=INFO,com.example.keycloak.x509:debug   # during rollout
+
+ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
+CMD ["start", "--optimized"]