21–30 of 111 posts
Why is `docker run` "unusual in production"? I prefer it over `docker-compose` because it eliminates one mostly useless layer of abstraction.
I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…
> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…
oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of manual point and click via the UI.
Anyone figured this out?
You don't need a bazillion keycloak instances, it has realms. 1 keycloak instance can have many realms. I won't get into the nonsense of having a single database server per any instance (not limited to keycloak). Such a waste of resources. You can have a system, postgres in this case, and make it listen on the docker iface, set it up to launch after and require docker.service. The nginx conf was interesting and I'll…
There is some kind of slowdown, and after around 200 realms things start breaking and startup time starts growing uncontrollably.
There's a good chance it's an issue in our setup (which is fairly complex), but every time we look at it we trace the slowdown back into keycloak itself
I did something similar, though picked Apache with mod_auth_openidc, which is a certified Relying Party implementation: https://github.com/OpenIDC/mod_auth_openidc In other words, I can protect arbitrary applications through my reverse proxy and require either certain claims/roles, or simplify auth to the point where my downstream app/API will just receive a bunch of headers like OIDC_CLAIM_sub, OIDC_CLAIM_name, OIDC…
Thanks for sharing.
Why is `docker run` "unusual in production"? I prefer it over `docker-compose` because it eliminates one mostly useless layer of abstraction.
The docker compose to plain docker run is the same as C/C++ to Assembly.
I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…
> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…
I am complaining but what is the alternative? Do it all yourself? It is either too risky or too difficult...