Fix Generali

docker-compose.yml

@@ -78,6 +78,8 @@ services:
         KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
         ORG_SERVICE_API_BASE_URL: http://localhost:${HOME_BACKEND_PORT}
         ATTIVITA_FE_BASE_URL: http://localhost:${ATTIVITA_FRONTEND_PORT}
+        MAGAZZINO_FE_BASE_URL: http://localhost:${MAGAZZINO_FRONTEND_PORT}
+        EVENTI_FE_BASE_URL: http://localhost:${EVENTI_FRONTEND_PORT}
     restart: unless-stopped
     ports:
       - "${HOME_FRONTEND_PORT}:80"
@@ -160,13 +162,11 @@ services:
   keycloak:
     image: quay.io/keycloak/keycloak:26.7
     restart: unless-stopped
-    # --import-realm importa keycloak/realm-export.json solo se il realm non esiste già
-    # NOTA: dopo l'import, assegnare al service account di scouthub-home-be i client role
-    # del client 'realm-management': manage-organizations, manage-users, manage-groups,
-    # view-users (permessi minimi, non manage-realm). Con Fine-Grained Admin Permissions
-    # (26.7+, feature admin-fine-grained-authz:v1) si puo' poi restringere ulteriormente
-    # per singola Organization.
-    command: start-dev --import-realm
+    # --import-realm importa keycloak/realm-export.json solo se il realm non esiste già.
+    # Le correzioni post-import (ruoli service account, protocol mapper "organization") non
+    # coperte dal file JSON sono automatizzate dal servizio one-shot "keycloak-init" sotto,
+    # non più manuali (vedi CLAUDE.md).
+    command: start-dev --import-realm --health-enabled=true
     environment:
       KC_DB: postgres
       KC_DB_URL: jdbc:postgresql://keycloak-db:5432/keycloak
@@ -187,6 +187,25 @@ services:
       - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
     depends_on:
       - keycloak-db
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 30s
+
+  keycloak-init:
+    image: alpine:3.20
+    restart: "no"
+    entrypoint: ["sh", "-c", "apk add --no-cache curl jq >/dev/null && sh /init-post-import.sh"]
+    environment:
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
+    volumes:
+      - ./keycloak/init-post-import.sh:/init-post-import.sh:ro
+    depends_on:
+      keycloak:
+        condition: service_healthy
 
 volumes:
   scouthub_db_data: