add initial KC test

Author: SamStaijen

ansible/main.yml

@@ -76,6 +76,8 @@
       tags: "intro_website"
     - role: "committeeclash"
       tags: "committeeclash"
+    - role: "keycloak"
+      tags: "keycloak"
     - role: "rottenspringbok"
       tags: "rottenspringbok"
     - role: "studytrip"

ansible/roles/keycloak/tasks/main.yaml

@@ -0,0 +1,45 @@
+---
+- name: "create user"
+  ansible.builtin.user:
+    name: "keycloak"
+    home: "{{ keycloak_project_source }}"
+    shell: "/usr/sbin/nologin"
+    state: "present"
+    system: true
+
+- name: "set up keycloak"
+  become_user: "keycloak"
+  become: true
+  block:
+  - name: "clone repository"
+    ansible.builtin.git:
+      repo: "https://github.com/svsticky/improved-adventure.git"
+      dest: "{{ keycloak_project_source }}"
+      depth: 1
+      version: main #"{% if 'production' in group_names %}main{% else %}development{% endif %}" # Pull main when deploying to prod
+    diff: false
+
+  - name: "Copy .env file"
+    ansible.builtin.template:
+      src: ".env.j2"
+      dest: "{{ keycloak_project_source }}/.env"
+    diff: false
+
+  - name: "Docker compose"
+    ansible.builtin.include_tasks: "../docker/tasks/compose-up.yml"
+    vars:
+      project_source: "{{ keycloak_project_source }}"
+      remove_images: all
+
+- name: "Copy nginx configuration"
+  ansible.builtin.template:
+    src: "keycloak.conf.j2"
+    dest: "/etc/nginx/sites-available/keycloak.{{ canonical_hostname }}.conf"
+  notify: "reload nginx"
+
+- name: "Enable nginx configuration for keycloak"
+  ansible.builtin.file:
+    src: "/etc/nginx/sites-available/keycloak.{{ canonical_hostname }}.conf"
+    path: "/etc/nginx/sites-enabled/keycloak.{{ canonical_hostname }}.conf"
+    state: link
+  notify: "reload nginx"

ansible/roles/keycloak/templates/.env.j2

@@ -0,0 +1,2 @@
+# TODO: add input here
+DB_PASSWORD=foobar

ansible/roles/keycloak/templates/keycloak.conf.j2

@@ -0,0 +1,19 @@
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name keycloak.{{ canonical_hostname }};
+
+  ssl_certificate /etc/letsencrypt/live/keycloak.{{ canonical_hostname }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/keycloak.{{ canonical_hostname }}/privkey.pem;
+  ssl_trusted_certificate /etc/letsencrypt/live/keycloak.{{ canonical_hostname }}/chain.pem;
+
+  location / {
+    proxy_pass http://localhost:{{ keycloak_port }}/;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header Host $http_host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+  }
+}
+

ansible/roles/keycloak/vars/main.yaml

@@ -0,0 +1,3 @@
+---
+keycloak_port: 6666
+keycloak_project_source: /var/www/keycloak