Keycloak 19.0在nginx（https）后台下无法加载管理控制台。

Question

我需要在反向代理nginx后面使用keycloak 19.0 docker版，

• 请求 --> https (nginx) ---> http keycloak

但是管理员控制台没有加载出来：URL (https://keycloak.xxx/admin/master/console/)。

在Chrome控制台上，我们可以看到错误：crbug/1173575，非JS模块文件已弃用。

Dockerfile

FROM quay.io/keycloak/keycloak:19.0 as builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_DB=postgres
# no need to activate preview feature:
# ENV KC_FEATURES=token-exchange
# ENV KC_FEATURES=admin2

# Install custom providers
RUN curl -sL https://github.com/aerogear/keycloak-metrics-spi/releases/download/2.5.3/keycloak-metrics-spi-2.5.3.jar -o /opt/keycloak/providers/keycloak-metr>

# Copy custom themes and plugins
# COPY /providers/*.jar providers/

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:19.0

COPY ./configs/nginx.conf /etc/nginx/nginx.conf
COPY ./configs/index.html /usr/share/nginx/html

COPY --from=builder /opt/keycloak/ /opt/keycloak/
WORKDIR /opt/keycloak

# ARGs

ARG KC_DB_URL
ARG KC_DB_SCHEMA
ARG KC_DB_USERNAME
ARG KC_DB_PASSWORD

ARG KC_HOSTNAME
ARG KC_PROXY

ARG KEYCLOAK_ADMIN
ARG KEYCLOAK_ADMIN_PASSWORD

# ENVs from ARGs

ENV KC_DB_URL=$KC_DB_URL
ENV KC_DB_SCHEMA=$KC_DB_SCHEMA
ENV KC_DB_USERNAME=$KC_DB_USERNAME
ENV KC_DB_PASSWORD=$KC_DB_PASSWORD


ENV KC_HOSTNAME=$KC_HOSTNAME
ENV KC_PROXY=$KC_PROXY
ENV KC_HOSTNAME_STRICT_HTTPS=false
ENV KC_HOSTNAME_STRICT=false
ENV KC_HTTP_ENABLED=true

ENV KEYCLOAK_ADMIN=$KEYCLOAK_ADMIN
ENV KEYCLOAK_ADMIN_PASSWORD=$KEYCLOAK_ADMIN_PASSWORD

ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized"]

docker-compose.yml

services:

  postgres:
    image: postgres
    container_name: keycloak-postgres
    restart: always
    env_file:
      - ./env/postgres.env
    volumes:
      - type: volume
        source: keycloak-postgres-data
        target: /var/lib/postgresql/data
        read_only: false
        volume:
          nocopy: true
    ports:
      - 5433:5432
    networks:
      - keycloak-backend

  keycloak-service:
    depends_on:
      - postgres
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - KC_DB_URL
        - KC_DB_SCHEMA
        - KC_DB_USERNAME
        - KC_DB_PASSWORD
        - KC_HOSTNAME
        - KC_PROXY
        - KEYCLOAK_ADMIN
        - KEYCLOAK_ADMIN_PASSWORD

    image: custom.keycloak:19.0
    container_name: keycloak-service
    restart: always
    env_file:
      - ./env/keycloak.env
    ports:
      - 8081:8080
    networks:
      - reverse-proxy-nginx
      - keycloak-backend

networks:
  reverse-proxy-nginx:
    external:
      name: reverse-proxy-nginx
  keycloak-backend:
    name: keycloak-backend

volumes:
  keycloak-postgres-data:
    external: true
    name: keycloak-postgres-data

环境变量 PostgreSQL

POSTGRES_DB=keycloak
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
IGNORE_INIT_HOOK_LOCKFILE=true

环境变量 Keycloak

KC_DB_URL="jdbc:postgresql://postgres:5432/keycloak"
KC_DB_SCHEMA=public
KC_DB_USERNAME=postgres
KC_DB_PASSWORD=postgres

KC_HOSTNAME="keycloak-service"
KC_PROXY=edge

KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin

#important for reverse proxy
PROXY_ADDRESS_FORWARDING=true
DB_VENDOR=POSTGRES
DB_ADDR=postgres
DB_PORT=5432
DB_DATABASE=keycloak
DB_USER=postgres
DB_PASSWORD=postgres

nginx

server {
    listen 80;
    server_name keycloak.xxx;
    server_tokens off;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://keycloak.xxx$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name keycloak.xxx;
    ssl_certificate /**/fullchain.pem;
    ssl_certificate_key /**/privkey.pem;

     proxy_set_header Host                  $host;
     proxy_set_header X-Forwarded-For       $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Host      $host;
     proxy_set_header X-Forwarded-Server    $host;
     #proxy_set_header X-Forwarded-Proto     $scheme;
     proxy_set_header X-Forwarded-Proto     https;


     location / {
         proxy_pass http://keycloak-service:8080;
     }
}

- alveomaster

Answer 1

我在使用jwilder/nginx-proxy和docker-compose时遇到了类似的问题。

将KC_HOSTNAME更改为实际的URL可以解决我的问题。在这种情况下，将其设置为keycloak.xxx（https://keycloak.xxx/admin/master/console/的一部分），而不是"keycloak-service"。

这个issue线程可能对未来遇到类似问题的人有用。

- meDev

Answer 2

proxy_pass 必须指向正在运行的服务器，即 proxy_pass http://localhost:8080;

- Deepak N