The compose sample demonstrates no BFF, so the only complete example is the integration-test config

[OliverWolffGIP]

Summary

deployment/compose-sample is positioned as the operator's deployment-shaped starting point, but it
demonstrates only a public proxy route. The BFF — the feature most people adopt this gateway for —
has no runnable sample, so an adopter has to reconstruct it from integration-tests/, which the
sample's own documentation tells them not to copy.

The gap, concretely

doc/user/compose-sample.adoc presents the sample as "a deployment-shaped stack you can run", and
docker-compose.yml is explicit that this is deliberate:

This is a SAMPLE, not a test harness. It deliberately carries none of the integration-tests
scaffolding […] because every one of those exists to exercise a test, not to show an operator how
the gateway is deployed.

That reasoning is right for toxiproxy and go-httpbin. It also excludes the oidc block, which is
not test scaffolding — it is the deployment door for the headline feature.

gateway.yaml in the sample acknowledges the omission:

Everything the integration suite needs and an operator does not — passthrough SNI, BFF sessions,
asset anchors, mTLS — is absent rather than present-and-disabled.

The premise there is that an operator does not need BFF sessions. For anyone adopting the gateway as
a BFF, that is the one thing they do need.

What the adopter path currently looks like

doc/user/bff-session.adoc gives an excellent field-by-field guide, but no complete working
document. So the only full, known-good BFF configuration is
integration-tests/src/main/docker/sheriff-config/. Copying from there means copying a document
authored for a test stack: container-internal issuer URLs, an it-static file-based JWKS issuer,
anchors named after test suites, and — see the sibling issue on Authorization in headers_allow —
at least one route setting that contradicts the reference documentation.

Working out which parts are the deployment shape and which are the test harness is the work the
sample exists to save.

Suggestion

An oidc overlay on the existing sample would probably be enough: the sample already ships Keycloak
with a realm import, so the missing pieces are a confidential client in that realm, an oidc block
with session.mode: server, one require: session route, and a static page as final_redirect.

That would also give the two BFF operator guides something to point at, and it would exercise the
same deployment door a real deployment uses — which is the sample's stated purpose.