fix: enable reverse proxy configuration for Keycloak (#65)

neumanf · Sep 20, 2024 · 0362bf2 · 0362bf2
1 parent d97040a
commit 0362bf2
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 3 deletions.
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
@@ -37,7 +37,8 @@ services:
             KC_METRICS_ENABLED: 'true'
             KC_HOSTNAME_STRICT_HTTPS: 'false'
             KC_HOSTNAME_URL: ${KEYCLOAK_URL}
-            KC_PROXY: reencrypt
+            KC_PROXY: edge
+            KC_PROXY_HEADERS: xforwarded
             KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
             KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
         depends_on:

diff --git a/docker-compose.testing.yml b/docker-compose.testing.yml
@@ -42,7 +42,8 @@ services:
             KC_METRICS_ENABLED: 'true'
             KC_HOSTNAME_STRICT_HTTPS: 'false'
             KC_HOSTNAME_URL: ${KEYCLOAK_URL:-http://0.0.0.0:9090}
-            KC_PROXY: reencrypt
+            KC_PROXY: edge
+            KC_PROXY_HEADERS: xforwarded
             KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
             KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
         depends_on:

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -42,7 +42,8 @@ services:
             KC_METRICS_ENABLED: 'true'
             KC_HOSTNAME_STRICT_HTTPS: 'false'
             KC_HOSTNAME_URL: ${KEYCLOAK_URL:-http://0.0.0.0:9090}
-            KC_PROXY: reencrypt
+            KC_PROXY: edge
+            KC_PROXY_HEADERS: xforwarded
             KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
             KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
         depends_on:

diff --git a/infra/nginx/conf/nginx.conf b/infra/nginx/conf/nginx.conf
@@ -80,5 +80,10 @@ server {
 
     location / {
         proxy_pass http://keycloak:8080;
+
+        proxy_set_header X-Forwarded-For $proxy_protocol_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port 443;
     }
 }