@decaf-ts/integrations 0.1.1

package/.gitlab-ci.yml

@@ -0,0 +1,197 @@
+variables:
+  FF_USE_FASTZIP: 1
+  CACHE_COMPRESSION_LEVEL: "fastest"
+  ARTIFACT_COMPRESSION_LEVEL: "fast"
+  CACHE_REQUEST_TIMEOUT: 5
+  # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_TLS_CERTDIR: ""
+
+cache:
+  - key: apt-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+    paths:
+      - apt-cache/
+
+default:
+  image: node:20
+  before_script:
+    - |
+      if [[ ! -f package.json ]]; then
+        echo "No package.json found! A package.json file is required to publish a package to GitLab's NPM registry."
+        echo 'For more information, see https://docs.gitlab.com/ee/user/packages/npm_registry/#creating-a-project'
+        exit 1
+      fi
+    - NPM_PACKAGE_NAME=$(node -p "require('./package.json').name")
+    - NPM_PACKAGE_VERSION=$(node -p "require('./package.json').version")
+    - export APT_CACHE_DIR=`pwd`/apt-cache && mkdir -pv $APT_CACHE_DIR
+    - apt-get update -yq && apt-get -o dir::cache::archives="$APT_CACHE_DIR" install wget libgbm-dev libnss3-dev libgdk-pixbuf2.0-dev libgtk-3-dev libxss-dev libasound2 -qy
+
+stages:
+  - dependencies
+  - build
+  - test
+  - publish
+
+install:
+  stage: dependencies
+  cache:
+    - key: dependencies-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - node_modules/
+        - .npm/
+  script:
+    - npm ci --cache .npm --prefer-offline
+  interruptible: true
+  only:
+    changes:
+      - package-lock.json
+      - .gitlab-ci.yml
+  retry:
+    max: 2
+    when:
+      - runner_system_failure
+      - stuck_or_timeout_failure
+
+build:
+  stage: build
+  cache:
+    - key: dependencies-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - node_modules/
+        - .npm/
+      policy: pull
+    - key: build-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - lib/
+        - dist/
+      policy: push
+  script:
+    - npm run build:prod
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master" && $CI_COMMIT_MESSAGE =~ /-no-ci/'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      changes:
+        - src/**/*
+        - tests/**/*
+        - package-lock.json
+        - tsconfig.json
+        - .gitlab-ci.yml
+    - if: '$CI_COMMIT_TAG'
+  interruptible: true
+
+tests:
+  stage: test
+  needs: ["build"]
+  script:
+    - npm run coverage
+  cache:
+    - key: dependencies-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - node_modules/
+        - .npm/
+      policy: pull
+    - key: build-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - lib/
+        - dist/
+      policy: pull
+    - key: test-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - workdocs/coverage/
+        - workdocs/badges/
+      policy: push
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master" && $CI_COMMIT_MESSAGE =~ /-no-ci/'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      changes:
+        - src/**/*
+        - tests/**/*
+        - package-lock.json
+        - tsconfig.json
+        - .gitlab-ci.yml
+    - if: '$CI_COMMIT_TAG'
+  artifacts:
+    when: always
+    reports:
+      junit:
+        - workdocs/coverage/junit-report.xml
+  coverage: '/^Statements.*?:.*?(\d+\.\d+)%/'
+  interruptible: true
+
+npm-publish:
+  stage: publish
+  needs: ["tests", "build"]
+  cache:
+    - key: dependencies-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - node_modules/
+        - .npm/
+      policy: pull
+    - key: build-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - lib/
+        - dist/
+      policy: pull
+  script:
+    - echo "Attempting to publish package ${NPM_PACKAGE_NAME} version ${NPM_PACKAGE_VERSION} to GitLab's NPM registry."
+    - TOKEN=${CI_JOB_TOKEN} npm publish
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master" && $CI_COMMIT_MESSAGE =~ /-no-ci/'
+      when: never
+    - if: '$CI_COMMIT_TAG'
+      when: always
+
+docker-publish:
+  stage: publish
+  needs: [ "tests", "build" ]
+  image: docker:20.10.21-dind
+  services:
+    - docker:20.10.21-dind
+  variables:
+    BASE_NAME: ts-workspace
+    LATEST_NAME: ${BASE_NAME}-latest
+  before_script:
+    - apk add jq
+    - VERSION=$(cat package.json | jq -r '.version')
+    - IMAGE_NAME="${IMAGE_BASE_NAME}-${VERSION}"
+    - echo "Image name is ${IMAGE_NAME}"
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+  script:
+    - echo "Building docker image to be published on $CI_REGISTRY."
+    - docker build --network host -t $CI_REGISTRY/decaf-ts/ts-workspace:${IMAGE_NAME} -t $CI_REGISTRY/decaf-ts/ts-workspace:${LATEST_NAME} -f Dockerfile .
+    - docker push $CI_REGISTRY/decaf-ts/ts-workspace:${IMAGE_NAME}
+    - docker push $CI_REGISTRY/decaf-ts/ts-workspace:${LATEST_NAME}
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master" && $CI_COMMIT_MESSAGE =~ /-no-ci/'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      changes:
+        - Dockerfile
+
+pages:
+  stage: publish
+  cache:
+    - key: dependencies-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - node_modules/
+        - .npm/
+      policy: pull
+    - key: test-$CI_COMMIT_REF_SLUG-$CI_PROJECT_DIR
+      paths:
+        - workdocs/coverage/
+        - workdocs/badges/
+      policy: pull
+  script:
+    - npm run docs
+    - mv docs public
+  artifacts:
+    paths:
+      - public
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      changes:
+        - workdocs/**/*
+    - if: '$CI_COMMIT_TAG'
+  interruptible: true

package/.prettierrc

@@ -0,0 +1,9 @@
+{
+  "trailingComma": "es5",
+  "max-len": {
+    "tabWidth": 2,
+    "code": 100,
+    "ignoreComments": true,
+    "ignoreTrailingComments": true
+  }
+}

package/.snyk

@@ -0,0 +1,12 @@
+ignore: {}
+patch: {}
+exclude:
+  global:
+    - dist/**
+    - lib/**
+    - node_modules/**
+    - tests/**
+    - workdocs/**
+    - gulpfile.js
+    - eslint.config.js
+    - jest.config.ts

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Tiago Venceslau 
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,22 @@
+# Decaf Integrations
+
+`@decaf-ts/integrations` centralizes reusable helpers for Keycloak, Kibana, and Nest-style auth.
+
+## Exports
+
+- `@decaf-ts/integrations`
+- `@decaf-ts/integrations/keycloak`
+- `@decaf-ts/integrations/kibana`
+- `@decaf-ts/integrations/nest`
+
+## Included Modules
+
+- Keycloak provisioning helpers for realms, users, roles, identity providers, and client-scoped role wiring.
+- Kibana provisioning helpers for spaces, data views, dashboards, and realm-specific access control.
+- Nest-style JWT helpers for extracting Keycloak roles and user context from access tokens.
+
+## Notes
+
+- Each subpath can be imported independently.
+- Peer dependencies are marked optional so consumers only install what they actually use.
+- The package is intended to be consumed from the Decaf workspace, but it is self-contained at the source level.

package/dist/integrations.cjs

@@ -0,0 +1,2 @@
+var e,o;e=this,o=(e,o,r,t)=>{"use strict";e.COMMIT="9134d75",e.FULL_VERSION="0.1.0-9134d75",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.1.0",e.execWithLogging=async(e,d,i,s=r.LogLevel.info)=>(i.debug("Executing: "+e),new Promise((r,c)=>{const n=o.exec(e,d);let a="",l="";n.stdout?.on("data",e=>{a+=e,i[s](e.trim())}),n.stderr?.on("data",e=>{l+=e,i.error(e.trim())}),n.on("close",e=>{0===e?(i.silly("Command completed successfully"),r({stdout:a,stderr:l})):(i.critical("Command failed with code "+e,l),c(new t.InternalError(`Command failed with code ${e}: ${l}`)))}),n.on("error",e=>{i.critical("Command execution error",e),c(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
+//# sourceMappingURL=integrations.cjs.map

package/dist/integrations.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.cjs","sources":["../src/index.ts","../src/utils.ts"],"sourcesContent":[null,null],"names":["async","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","trim","error","code","silly","critical","InternalError","err"],"mappings":"mDASsB,4BAEM,kCAEQ,wBANL,gCCExBA,MACLC,EACAC,EACAC,EACAC,EAAkBC,EAAAA,SAASC,QAE3BH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAAA,KAAKX,EAASC,GAE5B,IAAIW,EAAS,GACTC,EAAS,GAEbH,EAAME,QAAQE,GAAG,OAASC,IACxBH,GAAUG,EACVb,EAAIC,GAAOY,EAAKC,UAGlBN,EAAMG,QAAQC,GAAG,OAASC,IACxBF,GAAUE,EACVb,EAAIe,MAAMF,EAAKC,UAGjBN,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,SAAQC,aAElBX,EAAIkB,SAAS,4BAA4BF,EAAQL,GACjDJ,EACE,IAAIY,EAAAA,cAAc,4BAA4BH,MAASL,SAK7DH,EAAMI,GAAG,QAAUQ,IACjBpB,EAAIkB,SAAS,0BAA2BE,GACxCb,EAAOa"}

package/dist/integrations.js

@@ -0,0 +1,2 @@
+import{exec as o}from"child_process";import{LogLevel as r}from"@decaf-ts/logging";import{InternalError as t}from"@decaf-ts/db-decorators";async function e(e,c,d,i=r.info){return d.debug("Executing: "+e),new Promise((r,n)=>{const m=o(e,c);let s="",a="";m.stdout?.on("data",o=>{s+=o,d[i](o.trim())}),m.stderr?.on("data",o=>{a+=o,d.error(o.trim())}),m.on("close",o=>{0===o?(d.silly("Command completed successfully"),r({stdout:s,stderr:a})):(d.critical("Command failed with code "+o,a),n(new t(`Command failed with code ${o}: ${a}`)))}),m.on("error",o=>{d.critical("Command execution error",o),n(o)})})}const c="##VERSION##",d="##COMMIT##",i="##FULL_VERSION##",n="##PACKAGE##";export{d as COMMIT,i as FULL_VERSION,n as PACKAGE_NAME,c as VERSION,e as execWithLogging};
+//# sourceMappingURL=integrations.js.map

package/dist/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sources":["../src/utils.ts","../src/index.ts"],"sourcesContent":[null,null],"names":["async","execWithLogging","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","trim","error","code","silly","critical","InternalError","err","VERSION","COMMIT","FULL_VERSION","PACKAGE_NAME"],"mappings":"0IASOA,eAAeC,EACpBC,EACAC,EACAC,EACAC,EAAkBC,EAASC,MAI3B,OAFAH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAKX,EAASC,GAE5B,IAAIW,EAAS,GACTC,EAAS,GAEbH,EAAME,QAAQE,GAAG,OAASC,IACxBH,GAAUG,EACVb,EAAIC,GAAOY,EAAKC,UAGlBN,EAAMG,QAAQC,GAAG,OAASC,IACxBF,GAAUE,EACVb,EAAIe,MAAMF,EAAKC,UAGjBN,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,SAAQC,aAElBX,EAAIkB,SAAS,4BAA4BF,EAAQL,GACjDJ,EACE,IAAIY,EAAc,4BAA4BH,MAASL,SAK7DH,EAAMI,GAAG,QAAUQ,IACjBpB,EAAIkB,SAAS,0BAA2BE,GACxCb,EAAOa,MAGb,CC3CO,MAAMC,EAAkB,cAElBC,EAAS,aAETC,EAAe,mBAEfC,EAAuB"}

package/docker/1password-compose.yml

@@ -0,0 +1,24 @@
+version: "3.8"
+
+services:
+  1password:
+    image: none
+    build:
+      context: .
+      dockerfile: Dockerfile.1password
+    container_name: 1password-cli
+    restart: unless-stopped
+    volumes:
+      - op-data:/home/op/.1password
+    environment:
+      - OP_ACCOUNT_ID=
+      - OP_SESSION=
+    healthcheck:
+      test: ["CMD", "op", "--version"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+volumes:
+  op-data:

package/docker/aws-compose.yml

@@ -0,0 +1,24 @@
+services:
+  localstack:
+    image: localstack/localstack:3.5.0
+    container_name: localstack
+    ports:
+      - "4566:4566"
+    environment:
+      - LOCALSTACK_HOSTNAME=localhost
+      - DEFAULT_REGION=us-east-1
+      - SERVICES=secretsmanager
+      - DEBUG=${DEBUG:-}
+    volumes:
+      - localstack-data:/var/lib/localstack
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:4566/_localstack/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    restart: unless-stopped
+
+volumes:
+  localstack-data:
+    name: localstack-data

package/docker/azure-compose.yml

@@ -0,0 +1,23 @@
+version: "3.8"
+
+services:
+  azurite:
+    image: mcr.microsoft.com/azure-storage/azurite:3.33.0
+    container_name: azurite
+    restart: unless-stopped
+    command: azurite -l /data --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0
+    ports:
+      - "10000:10000"
+      - "10001:10001"
+      - "10002:10002"
+    volumes:
+      - azurite-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:10000"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+volumes:
+  azurite-data:

package/docker/compose.integration.yml

@@ -0,0 +1,164 @@
+version: "3.8"
+
+services:
+  # Keycloak - Identity Management
+  keycloak:
+    image: quay.io/keycloak/keycloak:24.0.0
+    container_name: keycloak-integration
+    command: start-dev
+    ports:
+      - "8080:8080"
+    environment:
+      - KC_DB=dev-file
+      - KC_HTTP_ENABLED=true
+      - KC_HOSTNAME_STRICT=false
+      - KC_HEALTH_ENABLED=true
+      - KC_READY_ENABLED=true
+      - KEYCLOAK_ADMIN=admin
+      - KEYCLOAK_ADMIN_PASSWORD=admin
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health/ready"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 40s
+    restart: unless-stopped
+
+  # Elasticsearch + Kibana - Search and Visualization
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.14.3
+    container_name: elasticsearch-integration
+    environment:
+      - discovery.type=single-node
+      - xpack.security.enabled=true
+      - xpack.security.enrollment.enabled=false
+      - ELASTIC_PASSWORD=elastic123
+      - discovery.seed_hosts=[]
+      - cluster.initial_master_nodes=elasticsearch
+      - network.host=0.0.0.0
+      - http.port=9200
+    ports:
+      - "9200:9200"
+    volumes:
+      - elasticsearch-data:/usr/share/elasticsearch/data
+    healthcheck:
+      test: ["CMD", "curl", "-s", "-f", "http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    restart: unless-stopped
+
+  kibana:
+    image: docker.elastic.co/kibana/kibana:8.14.3
+    container_name: kibana-integration
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    environment:
+      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
+      - ELASTICSEARCH_USERNAME=elastic
+      - ELASTICSEARCH_PASSWORD=elastic123
+      - XPACK_SECURITY_ENABLED=true
+      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+    ports:
+      - "5601:5601"
+    healthcheck:
+      test: ["CMD", "curl", "-s", "-f", "http://localhost:5601/api/status"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+    restart: unless-stopped
+
+  # LocalStack - AWS Services Emulator
+  localstack:
+    image: localstack/localstack:3.5.0
+    container_name: localstack-integration
+    ports:
+      - "4566:4566"
+      - "4571:4571"
+    environment:
+      - LOCALSTACK_HOSTNAME=localhost
+      - DEFAULT_REGION=us-east-1
+      - SERVICES=/aws-sdk
+      - DEBUG=${DEBUG:-}
+      - LOG squash
+    volumes:
+      - localstack-data:/var/lib/localstack
+      - ./init:/docker-entrypoint-initaws.d
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:4566/_localstack/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    restart: unless-stopped
+
+  # Azurite - Azure Storage emulator
+  azurite:
+    image: mcr.microsoft.com/azure-storage/azurite:3.33.0
+    container_name: azurite-integration
+    restart: unless-stopped
+    command: azurite -l /data --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0
+    ports:
+      - "10000:10000"
+      - "10001:10001"
+      - "10002:10002"
+    volumes:
+      - azurite-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:10000"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+  # GCP Emulator
+  gcp-emulator:
+    image: jldec/gcp-emulator:latest
+    container_name: gcp-emulator-integration
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    volumes:
+      - gcp-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+  # Hashicorp Vault
+  vault:
+    image: hashicorp/vault:1.15.6
+    container_name: vault-integration
+    restart: unless-stopped
+    environment:
+      - VAULT_DEV_ROOT_TOKEN_ID=my-root-token
+      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200
+    ports:
+      - "8200:8200"
+    volumes:
+      - vault-data:/vault/data
+    cap_add:
+      - IPC_LOCK
+    healthcheck:
+      test: ["CMD", "vault", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
+volumes:
+  elasticsearch-data:
+    name: elasticsearch-data
+  localstack-data:
+    name: localstack-data
+  azurite-data:
+    name: azurite-data
+  gcp-data:
+    name: gcp-data
+  vault-data:
+    name: vault-data

package/docker/gcp-compose.yml

@@ -0,0 +1,16 @@
+services:
+  gcp-emulator:
+    image: ghcr.io/blackwell-systems/gcp-secret-manager-emulator-dual:latest
+    container_name: gcp-emulator
+    restart: unless-stopped
+    environment:
+      - GCP_MOCK_LOG_LEVEL=info
+    ports:
+      - "8080:8080"
+      - "9091:9090"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://localhost:8080/v1/projects/healthcheck/secrets"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s

package/docker/keycloak-compose.yml

@@ -0,0 +1,24 @@
+services:
+  keycloak:
+    image: quay.io/keycloak/keycloak:24.0.0
+    container_name: keycloak
+    command: start-dev
+    ports:
+      - "8180:8080"
+    environment:
+      - KC_DB=dev-file
+      - KC_HTTP_ENABLED=true
+      - KC_HOSTNAME_STRICT=false
+      - KC_HEALTH_ENABLED=true
+      - KC_READY_ENABLED=true
+      - KEYCLOAK_ADMIN=admin
+      - KEYCLOAK_ADMIN_PASSWORD=admin
+    healthcheck:
+      # quay.io/keycloak/keycloak ships without curl/wget; probe the health
+      # endpoint over /dev/tcp instead.
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\r\nhost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q '\"status\": \"UP\"'"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 40s
+    restart: unless-stopped

package/docker/kibana-compose.yml

@@ -0,0 +1,67 @@
+services:
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.14.3
+    container_name: elasticsearch
+    environment:
+      - discovery.type=single-node
+      - xpack.security.enabled=true
+      - xpack.security.enrollment.enabled=false
+      - ELASTIC_PASSWORD=elastic123
+      - network.host=0.0.0.0
+      - http.port=9200
+      - cluster.routing.allocation.disk.threshold_enabled=false
+    ports:
+      - "9200:9200"
+    volumes:
+      - elasticsearch-data:/usr/share/elasticsearch/data
+    healthcheck:
+      test: ["CMD", "curl", "-s", "-f", "-u", "elastic:elastic123", "http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    restart: unless-stopped
+
+  kibana-setup:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.14.3
+    container_name: kibana-setup
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+    restart: "no"
+    entrypoint: ["sh", "-c"]
+    command:
+      - >
+        curl -s -f --max-time 10 --retry 10 --retry-delay 3 --retry-connrefused
+        -u elastic:elastic123 -X POST
+        -H "Content-Type: application/json"
+        http://elasticsearch:9200/_security/user/kibana_system/_password
+        -d '{"password":"kibana123"}'
+
+  kibana:
+    image: docker.elastic.co/kibana/kibana:8.14.3
+    container_name: kibana
+    depends_on:
+      elasticsearch:
+        condition: service_healthy
+      kibana-setup:
+        condition: service_completed_successfully
+    environment:
+      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
+      - ELASTICSEARCH_USERNAME=kibana_system
+      - ELASTICSEARCH_PASSWORD=kibana123
+      - XPACK_SECURITY_ENABLED=true
+      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+    ports:
+      - "5601:5601"
+    healthcheck:
+      test: ["CMD", "curl", "-s", "-f", "http://localhost:5601/api/status"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+    restart: unless-stopped
+
+volumes:
+  elasticsearch-data:
+    name: elasticsearch-data

package/docker/vault-compose.yml

@@ -0,0 +1,25 @@
+version: "3.8"
+
+services:
+  vault:
+    image: hashicorp/vault:1.15.6
+    container_name: vault
+    restart: unless-stopped
+    environment:
+      - VAULT_DEV_ROOT_TOKEN_ID=my-root-token
+      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200
+    ports:
+      - "8200:8200"
+    volumes:
+      - vault-data:/vault/data
+    cap_add:
+      - IPC_LOCK
+    healthcheck:
+      test: ["CMD", "vault", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
+volumes:
+  vault-data: