logging for keycloak

inventories/filebeat

@@ -3,10 +3,10 @@ dsoclab-nifi-1 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-curren
 dsoclab-nifi-2 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text"
 dsoclab-nifi-3 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text"
 dsoclab-misp ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-php72/log/php-fpm/*.log","/var/opt/rh/rh-redis32/log/redis/redis.log","/var/log/httpd/*log","/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="misp" FILEBEAT_LOG_FORMAT="text"
-#dsoclab-odfe-1 ansible_connection=docker FILEBEAT_FILES='[""]'
-#dsoclab-odfe-2 ansible_connection=docker FILEBEAT_FILES='[""]'
+#dsoclab-odfe-1 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/dsoclab-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe1" FILEBEAT_LOG_FORMAT="json"
+#dsoclab-odfe-2 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/dsoclab-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe2" FILEBEAT_LOG_FORMAT="json"
 dsoclab-kibana ansible_connection=docker FILEBEAT_FILES='["/usr/share/kibana/kblog"]' FILEBEAT_LOG_TYPE="kibana" FILEBEAT_LOG_FORMAT="text"
-#dsoclab-keycloak ansible_connection=docker FILEBEAT_FILES='[""]'
+dsoclab-keycloak ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="keycloak" FILEBEAT_LOG_FORMAT="text"
 dsoclab-mysql ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-mariadb103/log/mariadb/mariadb.log"]' FILEBEAT_LOG_TYPE="mysql" FILEBEAT_LOG_FORMAT="text"
 dsoclab-haproxy ansible_connection=docker FILEBEAT_SYSLOG_PORT=9000 FILEBEAT_LOG_TYPE="haproxy" FILEBEAT_LOG_FORMAT="text"
 #dsoclab-zookeeper ansible_connection=docker FILEBEAT_FILES='[""]'

roles/build/files/keycloaksupervisord.conf

+[unix_http_server]
+file=/tmp/supervisor.sock
+
+[supervisord]
+pidfile=/tmp/supervisord.pid
+nodaemon=true
+logfile=/var/log/supervisor/supervisord.log
+logfile_maxbytes=10MB
+logfile_backups=10
+loglevel=info
+childlogdir=/var/log/supervisor/
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock
+
+[program:keycloak]
+directory=/opt/jboss/keycloak
+user=jboss
+group=jboss
+#command=/opt/jboss/keycloak/bin/standalone.sh -b 0.0.0.0
+command=/bin/bash -c '/docker-java-home/jre/bin/java -D[Standalone] -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Dorg.jboss.boot.log.file=/opt/jboss/keycloak/standalone/log/server.log -Dlogging.configuration=file:/opt/jboss/keycloak/standalone/configuration/logging.properties -jar /opt/jboss/keycloak/jboss-modules.jar -mp /opt/jboss/keycloak/modules org.jboss.as.standalone -Djboss.home.dir=/opt/jboss/keycloak -Djboss.server.base.dir=/opt/jboss/keycloak/standalone -b 0.0.0.0'
+autostart=false
+autorestart=true
+logfile_maxbytes=10MB
+stdout_logfile_backups = 0
+stderr_logfile_backups = 0
+stderr_logfile = /var/log/supervisor/keycloak_stderr.log
+stdout_logfile = /var/log/supervisor/keycloak_stdout.log
+

roles/build/templates/keycloak/Dockerfile.j2

@@ -11,7 +11,7 @@ USER root
 #ADD /{{role_path}}/templates/keycloak/keycloak-tools /opt/jboss/tools
 ADD keycloak-tools /opt/jboss/tools
 #ADD ../templates/keycloak/keycloak-tools /opt/jboss/tools
-RUN yum -y install openssl && yum -y clean all && \
+RUN yum -y install openssl supervisor && yum -y clean all && \
     mkdir -p /opt/jboss/ && cd /opt/jboss/ && \
     curl -L $KEYCLOAK_DIST | tar zx && \
     mv /opt/jboss/keycloak-* /opt/jboss/keycloak && \
@@ -38,6 +38,6 @@ EXPOSE 8443
 
 RUN echo 'jboss ALL=(ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers
 
-USER jboss
-ENTRYPOINT ["/bin/bash"]
+COPY keycloaksupervisord.conf /etc/supervisord.conf
+ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
 

roles/docker/tasks/keycloak.yml

@@ -10,7 +10,6 @@
     networks_cli_compatible: yes
     published_ports:
       - "12443:8443"
-    entrypoint: "/bin/bash"
     interactive: "yes"
   with_items: "{{ groups['keycloakcontainers'] }}"
   tags:

roles/keycloak/tasks/main.yml

 ---
 
 - name: Copy certificates in keycloak x509 conf dir
+  remote_user: jboss
   copy:
     src:  "{{ item.local }}"
     dest: "{{ item.remote }}"
@@ -22,6 +23,7 @@
     - start
 
 - name: Generate Keycloak secure config
+  remote_user: jboss
   command: "/opt/jboss/tools/x509.sh"
   environment:
     X509_CA_BUNDLE: "/etc/x509/ca/ca.crt"
@@ -29,11 +31,13 @@
     - start
 
 - name: Set admin password
+  remote_user: jboss
   command: /opt/jboss/keycloak/bin/add-user-keycloak.sh --user "admin" --password "{{keycloak_adminpass}}"
   tags:
     - start
 
 - name: Configure Keycloak start script
+  remote_user: jboss
   template:
     src: "{{item}}.j2"
     dest: "/opt/jboss/tools/{{item}}"
@@ -46,11 +50,13 @@
 
 
 - name: Start Keycloak IdP
-  command: /opt/jboss/tools/startkeycloak.sh
+  remote_user: root
+  command: "supervisorctl start keycloak"
   tags:
     - start
 
 - name: Wait for Keycloak
+  remote_user: jboss
   wait_for:
     host: "{{groups['keycloakcontainers'][0]}}"
     port: 8443
@@ -60,11 +66,13 @@
     - start
 
 - name: Initialize Keycloak realm
+  remote_user: jboss
   command: /opt/jboss/tools/initkeycloakrealm.sh
   tags:
     - start
 
 - name: Copy secrets from Keycloak
+  remote_user: jboss
   fetch:
     src:  "{{ item.remote }}"
     dest: "{{ item.local }}"
@@ -78,6 +86,7 @@
     - start
 
 - name: Stop Keycloak
-  command: "pkill -SIGTERM -F {{inventory_hostname}}.pid"
+  remote_user: root
+  command: "supervisorctl stop keycloak"
   tags:
     - stop