[{"id":14832,"user_id":56922,"name":"keycloak-traefik-letsencrypt-docker-compose","description":"Keycloak with Let's Encrypt Using Docker Compose","homepage_url":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose","repo_url":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"GitHub and heyvaldemar.com are HTTPS only.","description_good_status":"Met","description_good_justification":"The README opens with what the project does and who it is for: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/README.md","interact_status":"Met","interact_justification":"The README says how to obtain it (git clone and a release tag), how to report a bug (GitHub issues) and how to contribute (pull requests): https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/README.md","contribution_status":"Met","contribution_justification":"Contributions go through pull requests on GitHub; every push runs the repository's own verification before a change is merged. https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/pulls","contribution_requirements_status":"Unmet","contribution_requirements_justification":"There is no CONTRIBUTING file; the README and the CI verification are the requirements a contribution meets.","license_location_status":"Met","license_location_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/LICENSE","floss_license_status":"Met","floss_license_justification":"MIT: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/LICENSE","floss_license_osi_status":"Met","floss_license_osi_justification":"MIT is OSI-approved.","documentation_basics_status":"Met","documentation_basics_justification":"Getting started, production checklist, backups and restore are in the README: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/README.md","documentation_interface_status":"Met","documentation_interface_justification":"Every variable the stack reads is documented in .env.example with its default and what it does: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/.env.example","repo_public_status":"Met","repo_public_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose","repo_track_status":"Met","repo_track_justification":"git, with every change as a commit: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/commits/main","repo_interim_status":"Met","repo_interim_justification":"Work lands on main between releases; releases are tagged from it: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/commits/main","repo_distributed_status":"Met","repo_distributed_justification":"git.","version_unique_status":"Met","version_unique_justification":"Every release is a tag vX.Y.Z: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/tags","version_semver_status":"Met","version_semver_justification":"Semantic versioning; the changelog names what each level means: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/CHANGELOG.md","version_tags_status":"Met","version_tags_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/tags","release_notes_status":"Met","release_notes_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/CHANGELOG.md, also published as GitHub release notes: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/releases","release_notes_vulns_status":"Met","release_notes_vulns_justification":"No CVE has been assigned to this project. Fixes with a security effect are named in the changelog with what was exposed: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/CHANGELOG.md","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/issues","report_process_status":"Met","report_process_justification":"Bugs are reported as GitHub issues, which the README names: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/issues","report_responses_status":"Met","report_responses_justification":"2 of 3 issues opened by others in the last twelve months received a response (66%): https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/issues?q=is%3Aissue","enhancement_responses_status":"Met","enhancement_responses_justification":"The same figure covers enhancement requests: 2 of 3 answered.","report_archive_status":"Met","report_archive_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/issues?q=is%3Aissue","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/SECURITY.md","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"GitHub private vulnerability reporting is enabled on this repository (Security → Report a vulnerability), and the policy names it first: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/SECURITY.md. The process is described at https://heyvaldemar.com/security/ and in https://heyvaldemar.com/.well-known/security.txt.","vulnerability_report_response_status":"N/A","vulnerability_report_response_justification":"No vulnerability report has been received in the last six months. The policy commits to an acknowledgment within seven days: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/SECURITY.md","build_status":"N/A","build_justification":"A deployment template: nothing is compiled. `docker compose up -d` assembles the stack from images pinned by digest; CI does exactly that on every push: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","build_common_tools_status":"N/A","build_common_tools_justification":"Nothing is compiled.","build_floss_tools_status":"N/A","build_floss_tools_justification":"Nothing is compiled; Docker Compose itself is FLOSS.","test_status":"Met","test_justification":"tests/e2e-backup-restore.sh deploys the stack, writes data, takes a backup, restores with the shipped restore scripts and requires the data back; it runs on every push and daily: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","test_invocation_status":"Met","test_invocation_justification":"`./tests/e2e-backup-restore.sh` from the repository root, documented in the README's Testing section: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/README.md","test_most_status":"Met","test_most_justification":"The test exercises the whole shipped stack end to end: deployment, HTTPS through the proxy, backup, restore, health. A weekly drill additionally restores the previous release's backup into the current release on a machine that has never run the stack: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/dr-drill.yml","test_policy_status":"Met","test_policy_justification":"A change to the stack ships with the test that exercises it; the README's Testing section says so, and the fleet-wide rule fails a repository whose restore script no test runs.","tests_are_added_status":"Met","tests_are_added_justification":"The commit history shows tests added with the changes they cover, for example the restore-script and clean-machine drill tests of September 2026: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/commits/main/tests","tests_documented_added_status":"Met","tests_documented_added_justification":"https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/README.md (Testing)","warnings_status":"Met","warnings_justification":"shellcheck, actionlint run in CI on every push and fail the build: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","warnings_fixed_status":"Met","warnings_fixed_justification":"CI fails on any finding, so none is left standing.","warnings_strict_status":"Met","warnings_strict_justification":"shellcheck at its default severity, which fails on informational findings too; actionlint on every workflow.","know_secure_design_status":"Met","know_secure_design_justification":"The maintainer has run production infrastructure for a decade, since 2016, and publishes on container and supply-chain security (Docker Captain, CNCF Ambassador, Snyk Ambassador): https://heyvaldemar.com/vladimir-mikhalev/. The design here shows it: least-privilege tokens per job, digest-pinned images, secrets never in the repository, signed releases with provenance.","know_common_errors_status":"Met","know_common_errors_justification":"The same, with the fleet's public record of what was found and fixed, each with the rule it produced: https://heyvaldemar.com/ledger/","crypto_published_status":"N/A","crypto_published_justification":"The project implements no cryptography; TLS is terminated by Traefik with Let's Encrypt certificates, and the applications bring their own.","crypto_call_status":"N/A","crypto_call_justification":"No cryptography is implemented here; TLS is Traefik's.","crypto_floss_status":"N/A","crypto_floss_justification":"Traefik and Let's Encrypt are FLOSS; nothing here depends on non-FLOSS cryptography.","crypto_keylength_status":"N/A","crypto_keylength_justification":"No cryptography is implemented here.","crypto_working_status":"N/A","crypto_working_justification":"No cryptography is implemented here.","crypto_pfs_status":"N/A","crypto_pfs_justification":"TLS is Traefik's, with its default modern cipher suites.","crypto_password_storage_status":"N/A","crypto_password_storage_justification":"The template stores no passwords; the deployed application does, by its own means.","crypto_random_status":"N/A","crypto_random_justification":"No cryptography is implemented here.","delivery_mitm_status":"Met","delivery_mitm_justification":"Everything is delivered over HTTPS from GitHub: the repository, the release archives and the container images.","delivery_unsigned_status":"Met","delivery_unsigned_justification":"Every release carries a git archive of the tag, a keyless Sigstore signature over it and SLSA build provenance, verifiable with cosign and slsa-verifier: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/releases","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"No unpatched publicly known vulnerability is open. Trivy scans every pinned image on every push and daily with results in the Security tab, Dependabot moves the pins, and the fleet's triage refreshes a drifted digest within the day: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/security","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"The same: a critical finding fails CI the day it appears and the pin moves the same day.","static_analysis_status":"Met","static_analysis_justification":"shellcheck, actionlint, Trivy on every push, failing the build on findings: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"Trivy scans the pinned images for known vulnerabilities on every push and daily, with results as SARIF in the Security tab.","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"CI fails on any finding; nothing is left standing.","static_analysis_often_status":"Met","static_analysis_often_justification":"On every push and on a daily schedule.","dynamic_analysis_status":"Met","dynamic_analysis_justification":"The shipped stack is exercised, not just read: deployed, driven over HTTPS, backed up and restored on every push, and restored onto a clean machine weekly with the time measured: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"No memory-unsafe code; shell and YAML.","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_enable_assertions_justification":"The tests assert on outcomes; the stack itself is not run with assertions enabled.","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"Nothing found by the end-to-end runs is left standing; a red run is fixed or reverted the same day by the fleet's triage.","general_comments":"","created_at":"2026-09-25T03:48:46.428Z","updated_at":"2026-10-13T23:52:36.266Z","crypto_weaknesses_status":"N/A","crypto_weaknesses_justification":"No cryptography is implemented here.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"GitHub Actions on every push: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/actions/workflows/deployment-verification.yml","cpe":"","discussion_status":"Met","discussion_justification":"GitHub issues and pull requests: https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/issues","no_leaked_credentials_status":"Met","no_leaked_credentials_justification":".env is ignored by git and required variables fail fast at deploy time; the fleet's secret scan reads the full history of every repository. Where a repository's history ever carried a generated-looking value, the README carries a pre-rotation advisory saying so.","english_status":"Met","english_justification":"Documentation, issues and commit messages are in English.","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":100,"achieved_passing_at":"2026-09-25T04:01:15.829Z","lost_passing_at":null,"implementation_languages":"Shell","badge_percentage_1":13,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":17,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":113,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2026-09-25T04:01:15.829Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","maintained_justification":"Verified by CI on every push and on a daily schedule; released as v1.7.7; the fleet-wide operations repository triages this repository twice a day.","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit Vladimir Mikhalev and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"}]