|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}") |
| 4 | +# shellcheck source=scripts/lib.sh |
| 5 | +source "${SCRIPT_DIR}/lib.sh" |
| 6 | + |
| 7 | +# Allow toggling verbose output |
| 8 | +[[ -n ${VERBOSE:-} ]] && set -x |
| 9 | +set -euo pipefail |
| 10 | + |
| 11 | +KEYCLOAK_VERSION="${KEYCLOAK_VERSION:-22.0}" |
| 12 | + |
| 13 | +cat <<EOF >/tmp/example-realm.json |
| 14 | +{ |
| 15 | + "realm": "coder", |
| 16 | + "enabled": true, |
| 17 | + "sslRequired": "none", |
| 18 | + "registrationAllowed": true, |
| 19 | + "privateKey": "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=", |
| 20 | + "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB", |
| 21 | + "requiredCredentials": ["password"], |
| 22 | + "users": [ |
| 23 | + { |
| 24 | + "username": "oidcuser", |
| 25 | + |
| 26 | + "emailVerified": true, |
| 27 | + "enabled": true, |
| 28 | + "credentials": [ |
| 29 | + { |
| 30 | + "type": "password", |
| 31 | + "value": "password" |
| 32 | + } |
| 33 | + ], |
| 34 | + "clientRoles": { |
| 35 | + "realm-management": ["realm-admin"], |
| 36 | + "account": ["manage-account"] |
| 37 | + } |
| 38 | + } |
| 39 | + ], |
| 40 | + "clients": [ |
| 41 | + { |
| 42 | + "clientId": "coder", |
| 43 | + "directAccessGrantsEnabled": true, |
| 44 | + "enabled": true, |
| 45 | + "fullScopeAllowed": true, |
| 46 | + "baseUrl": "/coder", |
| 47 | + "redirectUris": ["*"], |
| 48 | + "secret": "coder" |
| 49 | + } |
| 50 | + ] |
| 51 | +} |
| 52 | +EOF |
| 53 | + |
| 54 | +echo '== Starting Keycloak' |
| 55 | +docker rm -f keycloak || true |
| 56 | +# Start Keycloak |
| 57 | +docker run --rm -d \ |
| 58 | + --name keycloak \ |
| 59 | + -p 9080:8080 \ |
| 60 | + -e KEYCLOAK_ADMIN=admin \ |
| 61 | + -e KEYCLOAK_ADMIN_PASSWORD=password \ |
| 62 | + -v /tmp/example-realm.json:/opt/keycloak/data/import/example-realm.json \ |
| 63 | + "quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}" \ |
| 64 | + start-dev \ |
| 65 | + --import-realm |
| 66 | + |
| 67 | +echo '== Waiting for keycloak to become ready' |
| 68 | +# Start the timeout in the background so interrupting this script |
| 69 | +# doesn't hang for 60s. |
| 70 | +timeout 60s bash -c 'until curl -s --fail http://localhost:9080/realms/coder/.well-known/openid-configuration > /dev/null 2>&1; do sleep 0.5; done' || |
| 71 | + fatal 'Keycloak did not become ready in time' & |
| 72 | +wait $! |
| 73 | + |
| 74 | +echo '== Starting Coder' |
| 75 | +hostname=$(hostname -f) |
| 76 | +export CODER_OIDC_ISSUER_URL="http://${hostname}:9080/realms/coder" |
| 77 | +export CODER_OIDC_CLIENT_ID=coder |
| 78 | +export CODER_OIDC_CLIENT_SECRET=coder |
| 79 | +export CODER_DEV_ACCESS_URL="http://${hostname}:8080" |
| 80 | + |
| 81 | +exec "${SCRIPT_DIR}/develop.sh" "$@" |
0 commit comments