# Scenario B: IAM swap — Keycloak stands in for KeyCape over the same directory.
#
# The realm JSON is produced by scripts/test-scenario-b.sh before this stack
# starts; Keycloak imports it at boot. LLDAP is the same directory KeyCape reads,
# so this scenario changes the issuer and nothing else.
services:
  lldap:
    image: lldap/lldap:stable
    environment:
      - LLDAP_JWT_SECRET=devjwtsecret
      - LLDAP_LDAP_USER_PASS=adminpassword
      - LLDAP_LDAP_BASE_DN=dc=netkingdom,dc=local
    ports:
      - "3890:3890"
      - "17170:17170"

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    command: ["start-dev", "--import-realm"]
    environment:
      - KC_BOOTSTRAP_ADMIN_USERNAME=admin
      - KC_BOOTSTRAP_ADMIN_PASSWORD=admin
      - KC_HEALTH_ENABLED=true
    volumes:
      # Written by the scenario script from the migration output.
      - ./build/scenario-b/realm:/opt/keycloak/data/import:ro
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '\"status\": \"UP\"'"]
      interval: 5s
      timeout: 5s
      retries: 30