# Example: adding the hybrid x509 SPI to a custom Keycloak image.
# Merge these lines into your EXISTING Dockerfile — keep your current base tag,
# build options (KC_DB, KC_FEATURES, ...), and entrypoint.

FROM quay.io/keycloak/keycloak:26.0 AS builder

COPY target/keycloak-hybrid-x509-spi-1.0.0.jar /opt/keycloak/providers/

# Build-time option: must be set before `kc.sh build` (runtime-only won't work
# for images started with --optimized). `request` = client cert OPTIONAL.
ENV KC_HTTPS_CLIENT_AUTH=request

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:26.0
COPY --from=builder /opt/keycloak/ /opt/keycloak/

# Runtime config (usually set via Helm/manifest env instead of baked in):
#   KC_SPI_X509CERT_LOOKUP_PROVIDER=hybrid
#   (header name is inherited from your existing KC_SPI_X509CERT_LOOKUP_NGINX_* env
#    vars — leave those in the Helm values as-is)
#   KC_SPI_X509CERT_LOOKUP_HYBRID_TRUST_MODE=log        # then 'enforce' after cycle 3
#   KC_TRUSTSTORE_PATHS=/opt/keycloak/conf/truststores  # CA bundle (KC 25+)
#   KC_LOG_LEVEL=INFO,com.example.keycloak.x509:debug   # during rollout

ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
CMD ["start", "--optimized"]