DSPX-3636 update quickstart Keycloak docs

[jp-ayyappan]

Summary

• update the getting started Docker Compose Keycloak image to 26.2
• switch the docs quickstart compose file to KC_BOOTSTRAP_ADMIN_* variables
• remove the deprecated preview token-exchange feature flag from the docs quickstart Keycloak service

Context

Part of DSPX-3636. This mirrors the Keycloak 26 / standard token exchange work in opentdf/platform#3754.

Testing

• not run; docs compose YAML-only change

Summary by CodeRabbit

• Documentation
  • Updated the Docker Compose Keycloak image to the latest standard release.
  • Adjusted proxy settings to use header-based configuration.
  • Revised Keycloak bootstrap administrator environment variables and enabled the updated authorization feature set.
  • Standardized the platform certificates volume name used by Docker Compose.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 674dea11-e5ef-41e9-9d3b-f46fb8b919b9

📥 Commits

Reviewing files that changed from the base of the PR and between c98870d and ac5f835.

📒 Files selected for processing (1)

• docs/getting-started/docker-compose.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/getting-started/docker-compose.yaml

---

📝 Walkthrough

Walkthrough

The getting-started Docker Compose configuration updates Keycloak’s image, proxy setting, bootstrap administrator variables, enabled feature, and platform certificates volume name.

Changes

Keycloak Compose Configuration

Layer / File(s)	Summary
Update Keycloak runtime and volume configuration docs/getting-started/docker-compose.yaml	The Keycloak service now uses the OpenTDF image, KC_PROXY_HEADERS, updated bootstrap variables, admin-fine-grained-authz:v1, and the opentdf_platform_certs volume name.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through YAML bright,
Keycloak dons a newer light.
Proxy ears point xforwarded-way,
Bootstrap keys greet the day.
Certificates rest snug and true.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the quickstart Keycloak documentation update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-3636-standard-token-exchange-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the Keycloak service in the Docker Compose configuration from version 25.0 to 26.2, updating the admin environment variables and removing the KC_FEATURES setting. Feedback highlights that upgrading to Keycloak 26.2 requires replacing the deprecated KC_PROXY: edge environment variable with KC_PROXY_HEADERS: x-forwarded to prevent startup configuration errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

📄 Preview deployed to https://opentdf-docs-pr-364.surge.sh

[coderabbitai]

🧹 Nitpick comments (1)

docs/getting-started/docker-compose.yaml (1)

100-100: 🔒 Security & Privacy | 🔵 Trivial

Verify the proxy trust boundary.

KC_PROXY_HEADERS: xforwarded is supported, but Keycloak requires the proxy to overwrite X-Forwarded-* headers; otherwise clients can spoof origin or IP information. Keycloak also trusts all proxy addresses when KC_PROXY_TRUSTED_ADDRESSES is unset. Ensure Keycloak is reachable only through the trusted proxy, or configure trusted proxy CIDRs for non-local deployments. (keycloak.org)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/getting-started/docker-compose.yaml` at line 100, Update the Keycloak
configuration around KC_PROXY_HEADERS to enforce the proxy trust boundary:
ensure the service is reachable only through the trusted proxy, or set
KC_PROXY_TRUSTED_ADDRESSES to the appropriate proxy CIDRs for non-local
deployments, while preserving xforwarded support and requiring the proxy to
overwrite forwarded headers.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/getting-started/docker-compose.yaml`:
- Line 100: Update the Keycloak configuration around KC_PROXY_HEADERS to enforce
the proxy trust boundary: ensure the service is reachable only through the
trusted proxy, or set KC_PROXY_TRUSTED_ADDRESSES to the appropriate proxy CIDRs
for non-local deployments, while preserving xforwarded support and requiring the
proxy to overwrite forwarded headers.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee6f1438-a140-4222-af5f-be4a6fe6d53c

📥 Commits

Reviewing files that changed from the base of the PR and between d831fa8 and c98870d.

📒 Files selected for processing (1)

• docs/getting-started/docker-compose.yaml