From 4a021a5711f04947a9be52b9620482d78832066f Mon Sep 17 00:00:00 2001
From: Mike Kell <mtkell@proxmoxnode1.kellsupport.com>
Date: Fri, 13 Jun 2025 12:33:26 +0000
Subject: [PATCH] feat: conditional Keycloak via compose profile + Makefile
 probe

---
 .env          |  9 +++++++++
 kong/kong.yml | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .env

diff --git a/.env b/.env
new file mode 100644
index 0000000..448bb8d
--- /dev/null
+++ b/.env
@@ -0,0 +1,9 @@
+# .env  ──────────────────────────────────────────
+# Values you want to override permanently
+
+# If an external Keycloak exists, point here;
+# leave empty to fall back to the embedded container.
+KEYCLOAK_URL=https://kc.kellsupport.com
+
+# Custom project name (avoids long folder names in ~/.local/share/containers)
+COMPOSE_PROJECT_NAME=cmmc-platform
diff --git a/kong/kong.yml b/kong/kong.yml
index e69de29..6e12a9f 100644
--- a/kong/kong.yml
+++ b/kong/kong.yml
@@ -0,0 +1,40 @@
+_format_version: "3.0"
+_transform: true
+
+#########################################################
+#  Upstream — FastAPI service running in podman-compose
+#########################################################
+services:
+  - name: fastapi-svc
+    host: fastapi          # container alias on the internal network
+    port: 8000
+    protocol: http
+
+    routes:
+      # Public API
+      - name: api-root
+        paths: ["/api/"]
+        strip_path: true
+        methods: ["GET", "POST", "PUT", "PATCH", "DELETE"]
+        plugins:
+          # Enable CORS for local testing
+          - name: cors
+            config:
+              origins: ["*"]
+              methods: ["GET", "POST", "PUT", "PATCH", "DELETE"]
+              headers: ["Accept", "Content-Type", "Authorization"]
+              credentials: false
+              max_age: 3600
+
+      # Health probe exposed at /gateway-health
+      - name: gateway-health
+        paths: ["/gateway-health"]
+        strip_path: true
+        methods: ["GET"]
+
+plugins:
+  # Global rate-limit (optional; remove if you don’t need it yet)
+  - name: rate-limiting
+    config:
+      second: 25
+      policy: local