# ServiceDefinition: keycloak
# Source of truth: spec docs/13-service-catalog.md row 0; docs/15-identity-and-access.md; ADR-0014.
# public IdP | egress internet | PostgreSQL on Longhorn (irreplaceable, DR-critical) | auth native.
# Keycloak IS the IdP (root of trust): its own admin login is local + MFA, so it does not federate.
# Validates against schemas/servicedefinition.schema.json.
name: keycloak
kind: container
source:
  image: quay.io/keycloak/keycloak
exposure: public              # login/redirect flows for internet-exposed services; hardened (docs/15; R-DNS/R-NET)
egress: internet              # normal WAN egress (docs/03; R-NET-05)
storage:
  - name: db
    size: 10Gi
    class: longhorn           # PostgreSQL on 3-replica Longhorn; irreplaceable (docs/15, docs/04; R-STATE-02)
dependencies:
  - to: keycloak-db           # explicit allow: Keycloak -> its PostgreSQL (docs/13 graph; R-NET-02)
    port: 5432
    protocol: tcp
ingressRoutes:
  - host: keycloak.${BASE_DOMAIN}
    port: 8080                # HTTP listener; TLS terminates at the Gateway (docs/08, docs/09)
auth:
  mode: native                # it IS the IdP; own admin login is local + MFA (docs/15; ADR-0014). Documented exception.
update:
  channel: stable             # R-UPD-01
  range: ">=24.0.0"
  cadence: "0 4 * * *"
  autoRollbackOnFailedHealth: true   # R-UPD-03
observability:
  metrics: true
  slis:
    - up                      # IdP down/unhealthy is a critical alert (docs/10; R-OBS-01)
backup:
  policy: daily-offcluster    # DR-critical: rebuilds from DB + git realm config (docs/15, docs/04; R-STATE-03)