add migrate script to non-standalone image (#932)

Author: FoseFx

Dockerfile.service

@@ -1,11 +1,45 @@
-# you probably don't want to use this Dockerfile directly,
+# you probably don't want to build this Dockerfile directly,
 # use `make <svc>` instead
 
+#
+# pull deps
+#
+FROM debian:12.8 AS deps
+
+
+# renovate: datasource=github-releases depName=golang-migrate/migrate
+ARG MIGRATE_VERSION=4.18.1
+
+
+RUN apt update && \
+	apt install -y wget
+
+# get migrate
+RUN wget -q https://github.com/golang-migrate/migrate/releases/download/v$MIGRATE_VERSION/migrate.linux-amd64.tar.gz -O - | tar -xzvf - migrate
+
+
 # builder builds a go service
 # the build args SERVICE and VERSION must be set!
 
 FROM golang:1.23-bookworm AS builder
 
+#
+# build spice helper (for migrations)
+#
+
+WORKDIR /build/spice
+
+COPY go.* ./
+COPY libs libs
+COPY spicedb/migrations spicedb/migrations
+RUN go mod download
+COPY cmd/spice cmd/spice
+RUN CGO_ENABLED=0 GOOS=linux go build -a -o spice cmd/spice/spice.go
+
+#
+# build service
+#
+
 ARG SERVICE
 ARG VERSION
 
@@ -27,10 +61,22 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-X main.Version=${VERSION}" -a -
 
 FROM alpine:3.21.0 AS production
 
+RUN apk update && apk add postgresql-client --no-cache
+
 WORKDIR /app
 
+# copy deps
+COPY --from=deps /migrate /usr/bin/migrate
+COPY --from=builder /build/spice/spice /usr/bin/spice
+COPY docker-run-migrations.sh ./run-migrations.sh
+
+# copy app
 COPY --from=builder /build/app/app .
 COPY --from=builder /build/app/migrations ./migrations
+COPY spicedb ./spicedb
+
+# fix permissions
+RUN chmod +x run-migrations.sh
 RUN chmod +x app
 
 ENV PORT=80

libs/common/auth/auth.go

@@ -19,7 +19,7 @@ import (
 // to avoid ambiguity please read: https://wiki.helpwave.de/doc/keycloak-jedzCcERwF
 
 var (
-	DefaultOAuthIssuerURL   = "https://accounts.helpwave.de/realms/helpwave"
+	DefaultOAuthIssuerURL   = "https://id.helpwave.de/realms/main"
 	DefaultOAuthClientID    = "helpwave-services"
 	onlyFakeAuthEnabled     bool
 	insecureFakeTokenEnable = false