From 31420fc24ce21163d8172c1ae67daacb37945ba8 Mon Sep 17 00:00:00 2001 From: Guido Grazioli Date: Tue, 17 May 2022 18:59:10 +0200 Subject: [PATCH] update config options: keycloak and quarkus --- roles/keycloak_quarkus/defaults/main.yml | 15 +++++- .../keycloak_quarkus/meta/argument_specs.yml | 36 +++++++++++++ roles/keycloak_quarkus/tasks/fastpackages.yml | 2 +- roles/keycloak_quarkus/tasks/main.yml | 18 ++++++- .../templates/keycloak-sysconfig.j2 | 2 +- .../templates/keycloak.conf.j2 | 54 +++++++++---------- .../templates/keycloak.service.j2 | 2 +- .../templates/quarkus.properties.j2 | 19 +++++++ roles/keycloak_quarkus/vars/main.yml | 6 ++- 9 files changed, 120 insertions(+), 34 deletions(-) create mode 100644 roles/keycloak_quarkus/templates/quarkus.properties.j2 diff --git a/roles/keycloak_quarkus/defaults/main.yml b/roles/keycloak_quarkus/defaults/main.yml index 6778308..f8cefdd 100644 --- a/roles/keycloak_quarkus/defaults/main.yml +++ b/roles/keycloak_quarkus/defaults/main.yml @@ -26,12 +26,18 @@ keycloak_quarkus_master_realm: master ### Configuration settings keycloak_quarkus_bind_address: 0.0.0.0 keycloak_quarkus_host: localhost +keycloak_quarkus_http_enabled: True keycloak_quarkus_http_port: 8080 keycloak_quarkus_https_port: 8443 keycloak_quarkus_ajp_port: 8009 keycloak_quarkus_jgroups_port: 7600 keycloak_quarkus_java_opts: "-Xms1024m -Xmx2048m" +### TLS/HTTPS configuration +keycloak_quarkus_https_enabled: False +keycloak_quarkus_key_file: conf/server.key.pem +keycloak_quarkus_cert_file: conf/server.crt.pem + ### Enable configuration for database backend, clustering and remote caches on infinispan keycloak_quarkus_ha_enabled: False ### Enable database configuration, must be enabled when HA is configured @@ -42,6 +48,7 @@ keycloak_quarkus_http_relative_path: auth keycloak_quarkus_frontend_url: http://localhost:8080/auth keycloak_quarkus_metrics_enabled: False +keycloak_quarkus_health_enabled: True ### infinispan remote caches access (hotrod) keycloak_quarkus_ispn_user: supervisor @@ -67,4 +74,10 @@ keycloak_quarkus_default_jdbc: version: 9.4.1212 mariadb: url: 'jdbc:mariadb://localhost:3306/keycloak' - version: 2.7.4 \ No newline at end of file + version: 2.7.4 + +### logging configuration +keycloak_quarkus_log: file +keycloak_quarkus_log_level: info +keycloak_quarkus_log_file: data/log/keycloak.log +keycloak_quarkus_log_format: '%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n' diff --git a/roles/keycloak_quarkus/meta/argument_specs.yml b/roles/keycloak_quarkus/meta/argument_specs.yml index 78382f9..b10f83a 100644 --- a/roles/keycloak_quarkus/meta/argument_specs.yml +++ b/roles/keycloak_quarkus/meta/argument_specs.yml @@ -91,11 +91,27 @@ argument_specs: default: "localhost" description: "hostname" type: "str" + keycloak_quarkus_http_enabled: + default: true + description: "Enable listener on HTTP port" + type: "bool" keycloak_quarkus_http_port: # line 29 of defaults/main.yml default: 8080 description: "HTTP port" type: "int" + keycloak_quarkus_https_enabled: + default: false + description: "Enable listener on HTTPS port" + type: "bool" + keycloak_quarkus_key_file: + default: "conf/server.key.pem" + description: "The file path to a private key in PEM format" + type: "str" + keycloak_quarkus_cert_file: + default: "conf/server.crt.pem" + description: "The file path to a server certificate or certificate chain in PEM format" + type: "str" keycloak_quarkus_https_port: # line 30 of defaults/main.yml default: 8443 @@ -141,6 +157,10 @@ argument_specs: default: false description: "Whether to enable metrics" type: "bool" + keycloak_quarkus_health_enabled: + default: true + description: "If the server should expose health check endpoints" + type: "bool" keycloak_quarkus_ispn_user: # line 46 of defaults/main.yml default: "supervisor" @@ -201,3 +221,19 @@ argument_specs: default: "{{ keycloak_quarkus_default_jdbc[keycloak_quarkus_jdbc_engine].version }}" description: "Version for JDBC driver" type: "str" + keycloak_quarkus_log: + default: "file" + type: "str" + description: "Enable one or more log handlers in a comma-separated list" + keycloak_quarkus_log_level: + default: "info" + type: "str" + description: "The log level of the root category or a comma-separated list of individual categories and their levels" + keycloak_quarkus_log_file: + default: "data/log/keycloak.log" + type: "str" + description: "Set the log file path and filename relative to keycloak home" + keycloak_quarkus_log_format: + default: '%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n' + type: "str" + description: "Set a format specific to file log entries" diff --git a/roles/keycloak_quarkus/tasks/fastpackages.yml b/roles/keycloak_quarkus/tasks/fastpackages.yml index 78bc556..3dd28e1 100644 --- a/roles/keycloak_quarkus/tasks/fastpackages.yml +++ b/roles/keycloak_quarkus/tasks/fastpackages.yml @@ -14,7 +14,7 @@ packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | map('regex_findall', 'package (.+) is not installed$') | flatten }}" when: rpm_info.failed -- name: "Install packages: {{ packages_to_install }}" +- name: "Install packages: {{ packages_to_install | join(',') }}" become: yes ansible.builtin.yum: name: "{{ packages_to_install }}" diff --git a/roles/keycloak_quarkus/tasks/main.yml b/roles/keycloak_quarkus/tasks/main.yml index d350f6f..1d16c27 100644 --- a/roles/keycloak_quarkus/tasks/main.yml +++ b/roles/keycloak_quarkus/tasks/main.yml @@ -32,10 +32,26 @@ notify: - restart keycloak +- name: "Configure quarkus config for keycloak service" + ansible.builtin.template: + src: quarkus.properties.j2 + dest: "{{ keycloak.home }}/conf/quarkus.properties" + owner: "{{ keycloak.service_user }}" + group: "{{ keycloak.service_group }}" + mode: 0644 + notify: + - restart keycloak + - name: "Start and wait for keycloak service" ansible.builtin.include_tasks: start.yml - name: Check service status ansible.builtin.command: "systemctl status keycloak" register: keycloak_service_status - changed_when: False \ No newline at end of file + changed_when: False + +- name: Link default logs directory + ansible.builtin.file: + state: link + src: "{{ keycloak.home }}/{{ keycloak.log_file }}" + dest: /var/log/keycloak diff --git a/roles/keycloak_quarkus/templates/keycloak-sysconfig.j2 b/roles/keycloak_quarkus/templates/keycloak-sysconfig.j2 index 13a589e..b02de03 100644 --- a/roles/keycloak_quarkus/templates/keycloak-sysconfig.j2 +++ b/roles/keycloak_quarkus/templates/keycloak-sysconfig.j2 @@ -1,3 +1,3 @@ # {{ ansible_managed }} KEYCLOAK_ADMIN={{ keycloak_quarkus_admin_user }} -KEYCLOAK_ADMIN_PASSWORD='{{ keycloak_quarkus_admin_pass }}' \ No newline at end of file +KEYCLOAK_ADMIN_PASSWORD='{{ keycloak_quarkus_admin_pass }}' diff --git a/roles/keycloak_quarkus/templates/keycloak.conf.j2 b/roles/keycloak_quarkus/templates/keycloak.conf.j2 index 59d82a2..4d19073 100644 --- a/roles/keycloak_quarkus/templates/keycloak.conf.j2 +++ b/roles/keycloak_quarkus/templates/keycloak.conf.j2 @@ -1,29 +1,27 @@ # {{ ansible_managed }} +{% if keycloak_quarkus_db_enabled %} # Database -# Database vendor [dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres] -#db=postgres -# The username of the database user. -#db-username=keycloak -# The password of the database user. -#db-password=password -# The full database JDBC URL. If not provided, a default URL is set based on the selected database vendor. -#db-url=jdbc:postgresql://localhost/keycloak +db={{ keycloak_quarkus_jdbc_engine }} +db-url={{ keycloak_quarkus_jdbc_url }} +db-username={{ keycloak_quarkus_db_user }} +db-password={{ keycloak_quarkus_db_pass }} +{% endif %} # Observability -# If the server should expose metrics and healthcheck endpoints. -#metrics-enabled=true +metrics-enabled={{ keycloak_quarkus_metrics_enabled }} +health-enabled={{ keycloak_quarkus_health_enabled }} # HTTP -http-enabled=true -http-port=8080 -https-port=8443 -# The file path to a server certificate or certificate chain in PEM format. -#https-certificate-file=${kc.home.dir}conf/server.crt.pem -# The file path to a private key in PEM format. -#https-certificate-key-file=${kc.home.dir}conf/server.key.pem -# The proxy address forwarding mode if the server is behind a reverse proxy. -#proxy=reencrypt +http-enabled={{ keycloak_quarkus_http_enabled }} +http-port={{ keycloak_quarkus_http_port }} + +# HTTPS +https-port={{ keycloak_quarkus_https_port }} +{% if keycloak_quarkus_https_enabled %} +https-certificate-file={{ keycloak.home }}/{{ keycloak_quarkus_cert_file}} +https-certificate-key-file={{ keycloak.home }}/{{ keycloak_quarkus_key_file }} +{% endif %} # Do not attach route to cookies and rely on the session affinity capabilities from reverse proxy #spi-sticky-session-encoder-infinispan-should-attach-route=false @@ -32,12 +30,11 @@ hostname={{ keycloak_quarkus_host }} hostname-path={{ keycloak_quarkus_http_relative_path }} # Cluster -#cache=ispn -#Defines the cache mechanism for high-availability. [local, ispn] -#cache-config-file=conf/cache-ispn.xml -#Defines the file from which cache configuration should be loaded from. -#cache-stack=tcp -#Define the default stack to use for cluster communication and node discovery. [tcp, udp, kubernetes, ec2, azure, google] +{% if keycloak_quarkus_ha_enabled %} +cache=ispn +cache-config-file=conf/cache-ispn.xml +cache-stack=tcp +{% endif %} # Proxy # The proxy address forwarding mode if the server is behind a reverse proxy. [edge, reencrypt, passthrough] @@ -46,6 +43,7 @@ hostname-path={{ keycloak_quarkus_http_relative_path }} # Logging # The format of log entries. #log-format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n -# The log level of the root category or a comma-separated list of individual categories and their levels. -#log-level=info - +log=file +log-level={{ keycloak.log.level }} +log-file={{ keycloak.log.file }} +log-file-format={{ keycloak.log.format }} diff --git a/roles/keycloak_quarkus/templates/keycloak.service.j2 b/roles/keycloak_quarkus/templates/keycloak.service.j2 index a710ee2..fcfb633 100644 --- a/roles/keycloak_quarkus/templates/keycloak.service.j2 +++ b/roles/keycloak_quarkus/templates/keycloak.service.j2 @@ -7,7 +7,7 @@ After=network.target Type=simple EnvironmentFile=-/etc/sysconfig/keycloak PIDFile={{ keycloak_quarkus_service_pidfile }} -ExecStart={{ keycloak.home }}/bin/kc.sh start +ExecStart={{ keycloak.home }}/bin/kc.sh --auto-build start #--http-relative-path={{ keycloak_quarkus_http_relative_path }} [Install] diff --git a/roles/keycloak_quarkus/templates/quarkus.properties.j2 b/roles/keycloak_quarkus/templates/quarkus.properties.j2 new file mode 100644 index 0000000..cf133a3 --- /dev/null +++ b/roles/keycloak_quarkus/templates/quarkus.properties.j2 @@ -0,0 +1,19 @@ +# {{ ansible_managed }} +{% if keycloak_quarkus_ha_enabled %} +quarkus.infinispan-client.server-list={{ keycloak_quarkus_ispn_url }} +quarkus.infinispan-client.client-intelligence=HASH_DISTRIBUTION_AWARE +quarkus.infinispan-client.use-auth=true +quarkus.infinispan-client.auth-username={{ keycloak_quarkus_ispn_user }} +quarkus.infinispan-client.auth-password={{ keycloak_quarkus_ispn_pass }} +quarkus.infinispan-client.auth-realm=default +quarkus.infinispan-client.auth-server-name=infinispan +quarkus.infinispan-client.sasl-mechanism={{ keycloak_quarkus_ispn_sasl_mechanism }} +{% if keycloak_quarkus_ispn_use_ssl %} +quarkus.infinispan-client.trust-store={{ keycloak_quarkus_ispn_trust_store_path }} +quarkus.infinispan-client.trust-store-password={{ keycloak_quarkus_ispn_trust_store_password }} +quarkus.infinispan-client.trust-store-type=jks +{% endif %} +#quarkus.infinispan-client.use-schema-registration=true +#quarkus.infinispan-client.auth-client-subject +#quarkus.infinispan-client.auth-callback-handler +{% endif %} \ No newline at end of file diff --git a/roles/keycloak_quarkus/vars/main.yml b/roles/keycloak_quarkus/vars/main.yml index bca7d88..e5302f4 100644 --- a/roles/keycloak_quarkus/vars/main.yml +++ b/roles/keycloak_quarkus/vars/main.yml @@ -8,4 +8,8 @@ keycloak: cli_path: "{{ keycloak_quarkus_home }}/bin/kcadm.sh" service_user: "{{ keycloak_quarkus_service_user }}" service_group: "{{ keycloak_quarkus_service_group }}" - offline_install: "{{ keycloak_quarkus_offline_install }}" \ No newline at end of file + offline_install: "{{ keycloak_quarkus_offline_install }}" + log: + file: "{{ keycloak_quarkus_log_file }}" + level: "{{ keycloak_quarkus_log_level }}" + format: "{{ keycloak_quarkus_log_format }}" \ No newline at end of file