Keycloak custom theme

[kristianharju]

Adds a custom Eumetnet gdpr-theme for Keycloak, which is also packaged as a Docker image for Kubernetes init container deployment.

• The theme includes a custom login page and a custom terms and conditions page
• Theme files are also packed in a Docker image
• Adds Action Workflow to build and publish Docker image for the custom theme
• The custom login theme can be enabled manually:
  • Realm -> meteogate -> Realm settings -> Themes -> Login theme: gdpr-theme -> Save
• Required action for custom terms page can be enabled from:
  • Realm -> meteogate -> Authentication -> Required actions -> Terms and Conditions
  • To enable required action for existing user:
    • Users -> <username> -> Required user actions -> Terms and Conditions -> Save
• Other Keycloak pages still use the default theme

Theme will be deployed as init container in Codecentric Keycloak Helm chart, copying files to shared volume mounted by main Keycloak container.

[fjugipe]

Looks nice and works really great 👍

I was thinking since we need to use the keycloak-theme provider container in the actual deployment. What if we change the docker-compose.yml to do that aswell?

For example:

add depends_on to the auth service:

  auth:
    image: quay.io/keycloak/keycloak:24.0
    depends_on:
      init-custom-keycloak-themes:
        condition: service_completed_successfully

and change auth volumes to:

    volumes:
      - ./keycloak/config/realm_export/local_dev:/opt/keycloak/data/import
      - ./keycloak/providers:/opt/keycloak/providers/
      - ./keycloak/themes:/opt/keycloak/themes/
      - custom-themes:/opt/keycloak/themes/

add make a new init-custom-keycloak-themes service:

  init-custom-keycloak-themes:
    image: ghcr.io/eumetnet/dev-portal/keycloak-theme:latest
    command: sh -c "cp -R /theme/* /custom-themes/"
    build:
      context: keycloak
    volumes:
      - custom-themes:/custom-themes
    restart: "no" 

and a custom-themes volume to the the whole stack:

volumes:
 custom-themes:

Since the manage-services.sh is using -v with ./manage-services remove it will work just like a ephemeral volume in k8 and we can test how we will do it in production.

I know that in this context it is unnecessary complexation of the code, but any thoughts on this?