Initial commit: MKV → AVI web app (Docker + Keycloak OIDC)

- App FastAPI : recherche dans un dossier média, download original ou conversion en AVI Xvid (tone-mapping HDR→SDR, audio FR auto, MP3 stéréo) - Auth Keycloak OIDC (Authlib) optionnelle - 3 composes : app seule, stack local (keycloak.local), production (NPM) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-04 00:28:51 +02:00
commit fd2e0689bf
15 changed files with 1328 additions and 0 deletions
@@ -0,0 +1,87 @@
+# Stack tout-en-un : PostgreSQL + Keycloak (realm pré-importé) + l'app MKV→AVI.
+#
+#   docker compose -f docker-compose.keycloak.yml up -d --build
+#
+# ⚠️  Ajouter d'abord cette ligne à /etc/hosts (pour que le navigateur ET le
+#     conteneur voient Keycloak sous le même nom) :
+#         127.0.0.1  keycloak.local
+#
+# Accès :  app  -> http://localhost:8090   (login: alex / alex)
+#          admin Keycloak -> http://localhost:8080  (admin / admin)
+
+name: mkv2avi-stack
+
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: mkv2avi-db
+    environment:
+      POSTGRES_DB: keycloak
+      POSTGRES_USER: keycloak
+      POSTGRES_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
+    volumes:
+      - kc-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    restart: unless-stopped
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.0
+    container_name: mkv2avi-keycloak
+    command: ["start-dev", "--import-realm"]
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
+      KC_DB_USERNAME: keycloak
+      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN:-admin}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD:-admin}
+      # URL fixe : identique côté navigateur (via /etc/hosts) et côté app (via alias réseau)
+      KC_HOSTNAME: http://keycloak.local:8080
+      KC_HTTP_ENABLED: "true"
+      KC_HEALTH_ENABLED: "true"
+    volumes:
+      - ./keycloak/realm-mkv2avi.json:/opt/keycloak/data/import/realm-mkv2avi.json:ro
+    ports:
+      - "8080:8080"
+    networks:
+      default:
+        aliases:
+          - keycloak.local
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 40s
+    restart: unless-stopped
+
+  mkv2avi:
+    build: .
+    image: mkv2avi:latest
+    container_name: mkv2avi
+    ports:
+      - "8090:8000"
+    volumes:
+      - ${MEDIA_DIR:-./media}:/media:ro
+      - ${OUTPUT_DIR:-./output}:/output
+    environment:
+      - MAX_WORKERS=1
+      - OIDC_ISSUER=http://keycloak.local:8080/realms/mkv2avi
+      - OIDC_CLIENT_ID=mkv2avi
+      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-mkv2avi-secret-change-me}
+      - SESSION_SECRET=${SESSION_SECRET:-dev-insecure-change-me}
+      - SESSION_HTTPS_ONLY=false
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  kc-db: