@@ -16,8 +16,7 @@ let
1616 };
1717
1818 nodes = {
19− keycloak = { ... }: {
20−
19+ keycloak = { config, ... }: {
2120 security.pki.certificateFiles = [
2221 certs.ca.cert
2322 ];
@@ -36,6 +35,10 @@ let
3635 username = "bogus";
3736 passwordFile = pkgs.writeText "dbPassword" "wzf6vOCbPp6cqTH";
3837 };
38+ plugins = with config.services.keycloak.package.plugins; [
39+ keycloak-discord
40+ keycloak-metrics-spi
41+ ];
3942 };
4043
4144 environment.systemPackages = with pkgs; [
@@ -102,8 +105,21 @@ let
102105 ### Realm Setup ###
103106
104107 # Get an admin interface access token
108+ keycloak.succeed("""
109+ curl -sSf -d 'client_id=admin-cli' \
110+ -d 'username=admin' \
111+ -d 'password=${initialAdminPassword}' \
112+ -d 'grant_type=password' \
113+ '${frontendUrl}/realms/master/protocol/openid-connect/token' \
114+ | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
115+ """)
116+
117+ # Register the metrics SPI
105118 keycloak.succeed(
106− "curl -sSf -d 'client_id=admin-cli' -d 'username=admin' -d 'password=${initialAdminPassword}' -d 'grant_type=password' '${frontendUrl}/realms/master/protocol/openid-connect/token' | jq -r '\"Authorization: bearer \" + .access_token' >admin_auth_header"
119+ "${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt",
120+ "KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' ${pkgs.keycloak}/bin/kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password '${initialAdminPassword}'",
121+ "KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' ${pkgs.keycloak}/bin/kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'",
122+ "curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"
107123 )
108124
109125 # Publish the realm, including a test OIDC client and user