ARG KC_TAG=22.0
FROM quay.io/keycloak/keycloak:${KC_TAG} as builder

# Enable health and metrics support
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true

ARG KC_DB=
RUN test "${KC_DB}" || { echo \${KC_DB} must be set!; exit 1; }

WORKDIR /opt/keycloak
# for demonstration purposes only, please make sure to use proper certificates in production instead
RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:idm.test.hfh-it.de,IP:192.168.44.11" -keystore conf/server.keystore
RUN /opt/keycloak/bin/kc.sh build


FROM quay.io/keycloak/keycloak:${KC_TAG}

COPY --from=builder /opt/keycloak/ /opt/keycloak/

USER root
COPY entrypoint /sa-entrypoint
RUN chmod 544 /sa-entrypoint

USER keycloak
ENTRYPOINT ["/bin/sh", "/sa-entrypoint"]
CMD ["start", "--optimized"]