27 lines
1.1 KiB
Docker
27 lines
1.1 KiB
Docker
# Example: adding the hybrid x509 SPI to a custom Keycloak image.
|
|
# Merge these lines into your EXISTING Dockerfile — keep your current base tag,
|
|
# build options (KC_DB, KC_FEATURES, ...), and entrypoint.
|
|
|
|
FROM quay.io/keycloak/keycloak:26.0 AS builder
|
|
|
|
COPY target/keycloak-hybrid-x509-spi-1.0.0.jar /opt/keycloak/providers/
|
|
|
|
# Build-time option: must be set before `kc.sh build` (runtime-only won't work
|
|
# for images started with --optimized). `request` = client cert OPTIONAL.
|
|
ENV KC_HTTPS_CLIENT_AUTH=request
|
|
|
|
RUN /opt/keycloak/bin/kc.sh build
|
|
|
|
FROM quay.io/keycloak/keycloak:26.0
|
|
COPY --from=builder /opt/keycloak/ /opt/keycloak/
|
|
|
|
# Runtime config (usually set via Helm/manifest env instead of baked in):
|
|
# KC_SPI_X509CERT_LOOKUP_PROVIDER=hybrid
|
|
# KC_SPI_X509CERT_LOOKUP_HYBRID_SSL_CLIENT_CERT=<your existing header name>
|
|
# KC_SPI_X509CERT_LOOKUP_HYBRID_TRUST_MODE=log # then 'enforce' after cycle 3
|
|
# KC_TRUSTSTORE_PATHS=/opt/keycloak/conf/truststores # CA bundle (KC 25+)
|
|
# KC_LOG_LEVEL=INFO,com.example.keycloak.x509:debug # during rollout
|
|
|
|
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
|
|
CMD ["start", "--optimized"]
|