Keycloak

docker run --rm -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=<PASSWORD> \
  quay.io/keycloak/keycloak:<TAG> start-dev

services:
  keycloak:
    image: quay.io/keycloak/keycloak:<TAG>
    restart: unless-stopped
    command: start
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${KC_DB_PASSWORD}
      KC_HOSTNAME: https://sso.example.com
      KC_HTTP_ENABLED: "true"            # proxy terminates TLS
      KC_PROXY_HEADERS: xforwarded       # or "forwarded"
      KC_HEALTH_ENABLED: "true"
      KC_BOOTSTRAP_ADMIN_USERNAME: admin           # first start only
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "127.0.0.1:8080:8080"
  db:
    image: postgres:<TAG>
    restart: unless-stopped
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD}
    volumes:
      - kc-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 10s
      retries: 5
volumes:
  kc-db:

curl -s -X POST https://sso.example.com/realms/<REALM>/protocol/openid-connect/token \
  -d grant_type=client_credentials -d client_id=<CLIENT_ID> -d client_secret=<CLIENT_SECRET> | jq .access_token

# DB backup is the real backup
docker compose exec db pg_dump -U keycloak keycloak > keycloak.sql
# realm export (stop the server container first, or use the admin console: Realm settings > Action > Partial export)
/opt/keycloak/bin/kc.sh export --dir /tmp/export --realm homelab