mirror of
https://github.com/mcloh/codex-chatgpt-mcp-proxy.git
synced 2026-11-05 21:34:11 +00:00
33 lines
1.6 KiB
YAML
33 lines
1.6 KiB
YAML
# Optional routing for an EXISTING Keycloak on the existing proxy network.
|
|
# No Keycloak restart, credentials or Docker socket required by this container.
|
|
services:
|
|
identity-route:
|
|
image: ${BRIDGE_NGINX_IMAGE:?Set a verified Nginx image digest}
|
|
user: "101:101"
|
|
entrypoint: ["/bin/sh", "-c"]
|
|
command:
|
|
- 'envsubst ''$${BRIDGE_KEYCLOAK_UPSTREAM} $${BRIDGE_PUBLIC_HOST}'' < /etc/bridge/nginx.conf.template > /tmp/nginx.conf && exec nginx -c /tmp/nginx.conf -g ''daemon off;'''
|
|
environment:
|
|
BRIDGE_KEYCLOAK_UPSTREAM: ${BRIDGE_KEYCLOAK_UPSTREAM:?Set existing Keycloak internal URL}
|
|
BRIDGE_PUBLIC_HOST: ${BRIDGE_PUBLIC_HOST}
|
|
volumes:
|
|
- ./deploy/keycloak-nginx.conf.template:/etc/bridge/nginx.conf.template:ro
|
|
networks:
|
|
- proxy
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=32M,mode=1777
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
mem_limit: 64m
|
|
pids_limit: 32
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.docker.network: ${BRIDGE_PROXY_NETWORK}
|
|
traefik.http.routers.codex-bridge-identity.rule: Host(`${BRIDGE_PUBLIC_HOST}`) && (PathPrefix(`/realms/codex-bridge/`) || PathPrefix(`/resources/`) || Path(`/.well-known/oauth-authorization-server/realms/codex-bridge`))
|
|
traefik.http.routers.codex-bridge-identity.entrypoints: ${BRIDGE_PROXY_ENTRYPOINT:-websecure}
|
|
traefik.http.routers.codex-bridge-identity.tls: "true"
|
|
traefik.http.routers.codex-bridge-identity.tls.certresolver: ${BRIDGE_TLS_RESOLVER}
|
|
traefik.http.services.codex-bridge-identity.loadbalancer.server.port: "8080"
|