lan.yml

# An override for opening this from another machine on the network.
#
#   ARKHE_DEMO_HOST=192.168.1.20 docker compose -f docker-compose.yml -f lan.yml up -d
#
# What it listens on and what the issuer says are different things
#
# Publishing on 0.0.0.0 is not enough. The issuer and the redirect_uri have to be the URL
# the browser actually requests, so a concrete address is needed. 0.0.0.0 is the
# unspecified address and cannot be a destination; a browser reads it as localhost, so
# another machine would try to connect to itself.
#
#   listening      0.0.0.0                    accept on any interface
#   issuer         ${ARKHE_DEMO_HOST}:8080    the URL the browser requests
#   redirect_uri   ${ARKHE_DEMO_HOST}:8057    the string Keycloak compares against
#
# Why the default stays 127.0.0.1
#
# These services keep their demonstration secrets in plain text, Keycloak runs in
# development mode, and the users' passwords are published in the README. None of that
# belongs on a network by default, so exposing it is a deliberate step.
#
# arkhe reaches Keycloak at the same address, going out through the host's published port
# and back. It is a detour, but it keeps the issuer a single string.

services:
  keycloak:
    environment:
      # Without changing KC_HOSTNAME, the issuer is built from the request Host and
      # differs depending on the route taken.
      KC_HOSTNAME: http://${ARKHE_DEMO_HOST:?set ARKHE_DEMO_HOST to this machine's address on the network, for example 192.168.1.20}:8080
    ports: !override
      - "0.0.0.0:8080:8080"

  arkhe:
    environment:
      ARKHE_OIDC_ISSUER: http://${ARKHE_DEMO_HOST}:8080/realms/arkhe
    ports: !override
      - "0.0.0.0:8057:8000"

  resolver:
    # Resolution needs no authentication, so only the published address changes here.
    ports: !override
      - "0.0.0.0:8058:8000"

  # No particular address is baked into the realm JSON; it is added here at startup.
  lan-redirect:
    image: arkhe:local
    depends_on:
      keycloak: {condition: service_healthy}
    environment:
      ARKHE_DEMO_HOST: ${ARKHE_DEMO_HOST}
    volumes:
      - ./lan-redirect.py:/lan-redirect.py:ro
    command: ["python", "/lan-redirect.py"]
    restart: "no"