version: "3.8"

services:
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    # Port 3000 ist optional, da Traefik den Traffic intern leitet
    #ports:
#      - "3000:3000" 
    volumes:
      - /mnt/docker/grafana:/var/lib/grafana
    environment:
      # Die externe URL über deinen Reverse Proxy
      - GF_SERVER_ROOT_URL=https://grafana.ljh31.de 
      
      # --- Keycloak / OAuth Konfiguration ---
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=3fS4ekbEC4RC0XndJQ1y6B8YJ4wvWFDc
      # URLs zu deinem Keycloak-Server unter deiner Domain
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/userinfo
      - GF_AUTH_GENERIC_OAUTH_SCOPE=openid profile email
    
    networks:
      - infra-traefik_default 

    labels:
      - "traefik.enable=true"
      # Routing über deine Domain ljh31.de
      - "traefik.http.routers.grafana.rule=Host(`grafana.ljh31.de`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

    restart: unless-stopped

networks:
  infra-traefik_default:
    external: true