Add Keycloak CI/CD with PostgreSQL backup

.gitea/workflows/keycloak.yml

@@ -0,0 +1,34 @@
+name: Keycloak CI/CD
+
+on:
+  push:
+    paths:
+      - "stacks/keycloak/**"
+      - "scripts/deploy-keycloak.sh"
+      - ".gitea/workflows/keycloak.yml"
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+
+jobs:
+
+  keycloak:
+
+    name: Deploy Keycloak
+
+    runs-on: docker-home-01
+
+    steps:
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Deploy Keycloak
+        if: ${{ gitea.ref == 'refs/heads/main' }}
+        run: |
+          ./scripts/deploy-keycloak.sh

stacks/keycloak/docker-compose.yml

@@ -0,0 +1,44 @@
+services:
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.0.5
+    container_name: keycloak
+
+    command:
+      - start
+
+    env_file:
+      - /srv/nfs/infra/keycloak/env/kc.env
+
+    environment:
+      # Нужны для корректной post-deploy проверки.
+      KC_HEALTH_ENABLED: "true"
+
+      # При включенных metrics /health/ready включает
+      # проверку соединения с БД.
+      KC_METRICS_ENABLED: "true"
+
+    networks:
+      - interdock
+
+    volumes:
+      - /srv/nfs/infra/keycloak/providers:/opt/keycloak/providers:ro
+      - /srv/nfs/infra/keycloak/themes:/opt/keycloak/themes:ro
+
+    restart: unless-stopped
+
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "{ printf 'HEAD /health/ready HTTP/1.0\\r\\n\\r\\n' >&0; grep 'HTTP/1.0 200'; } 0<>/dev/tcp/127.0.0.1/9000"
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 40s
+
+
+networks:
+  interdock:
+    external: true