## Cave Keycloak — Keycloak 26 with the cave login theme and realm baked in.
##
## Build: podman build -t cave-keycloak -f Containerfile.keycloak .
## Run:   see deploy/quadlet/cave-keycloak.container, or use cavectl.
##
## Notes:
##  - The realm import in /opt/keycloak/data/import/cave-realm.json runs on
##    first start when the container is launched with --import-realm.
##  - The login theme references parent=keycloak.v2 (shipped in keycloak 26),
##    so no patching of the base image is required.
##  - KC_HOSTNAME / KEYCLOAK_ADMIN* must be set at runtime, not baked in.

## Multi-stage build: pre-bake the postgres driver into keycloak via `kc.sh
## build`, so we can run `start --optimized` at runtime without keycloak
## refusing because build-time options differ from what's persisted.
FROM quay.io/keycloak/keycloak:26.0 AS builder

COPY --chown=1000:0 keycloak/themes/cave /opt/keycloak/themes/cave
COPY --chown=1000:0 keycloak/cave-realm.json /opt/keycloak/data/import/cave-realm.json

ENV KC_DB=postgres
RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:26.0

COPY --from=builder /opt/keycloak/ /opt/keycloak/

USER root
COPY keycloak/entrypoint.sh /usr/local/bin/cave-keycloak-entrypoint.sh
RUN chmod +x /usr/local/bin/cave-keycloak-entrypoint.sh
USER 1000

ENTRYPOINT ["/usr/local/bin/cave-keycloak-entrypoint.sh"]