# The name of the Nomad job.
job_name = "keycloak"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Keycloak container image (26.x). Pin a tag in production.
image = "quay.io/keycloak/keycloak:latest"

# Host port for Keycloak's HTTP listener. Serves plain HTTP — front it with a reverse proxy (Traefik) for TLS.
port = 8080

# Public hostname/URL Keycloak is served at (e.g. https://auth.example.com), set when fronting it with a domain. Empty = hostname-strict is off and Keycloak infers it from the request (fine for IP access / testing).
hostname = ""

# Bootstrap admin username, created on first start with an empty database.
admin_user = "admin"

# Bootstrap admin password. CHANGE THIS. Only applied on first start (empty DB); rotate it in the console afterwards.
admin_password = "admin"

# Resources for the Keycloak (JVM) task.
keycloak_resources = {
    cpu    = 1000
    memory = 1024
  }

# PostgreSQL image backing Keycloak.
postgres_image = "postgres:16-alpine"

# Host port PostgreSQL listens on. Keycloak connects on 127.0.0.1 (same host network namespace).
db_port = 5432

# Password for the Keycloak database user. CHANGE THIS. (DB name and user are both "keycloak".)
db_password = "keycloak"

# Docker named volume for the Postgres data dir. This is the critical state (realms, users, clients) — back it up. A fresh volume inherits the image's data-dir ownership so Postgres can write it.
db_data_volume = "keycloak_db_data"

# Resources for the PostgreSQL task.
postgres_resources = {
    cpu    = 500
    memory = 512
  }

# Placement constraints — pin the job to one node so the Postgres local volume stays put (single all-in-one alloc). On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []