version: "3.8"

services:
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    ports:
      - "3000:3000"
    volumes:
      - /mnt/docker/grafana:/var/lib/grafana
    environment:
      - GF_SERVER_ROOT_URL=http://<DEINE_GRAFANA_IP>:3000 
      # --- Keycloak / OAuth Konfiguration ---
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=DEIN_KOPIERTER_SECRET_AUS_KEYCLOAK
      # Die URLs hängen von deiner Keycloak-Version ab (meistens /auth/ oder direkt /realms/)
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/userinfo
      # Mapping: Welches Keycloak-Feld wird als Name/Email in Grafana genutzt?
      - GF_AUTH_GENERIC_OAUTH_SCOPE=openid profile email
    restart: unless-stopped