fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177 )

KC_HOSTNAME_BACKCHANNEL_DYNAMIC builds the token/userinfo/certs URLs from the request, which reaches Keycloak as plain http through the proxy, so browsers blocked them as mixed content after login. Trust X-Forwarded-Proto. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-25 10:40:46 +02:00
1 changed files with 5 additions and 0 deletions
@@ -275,6 +275,11 @@ workloads:
      # this issuer back, which is what browser tokens carry (infra/host-browser.yml).
      KC_HOSTNAME: '{{ include "big.keycloakUrl" . }}'
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
      # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token,
      # userinfo, certs — take their scheme from the request, which reaches Keycloak
      # as plain http; trusting X-Forwarded-Proto keeps them https so the browser
      # doesn't block them as mixed content. In-cluster calls send no such header.
      KC_PROXY_HEADERS: xforwarded
    ports: [{ name: http, port: 8080 }]
    # TCP, not /health/ready on the management port: nothing here gates on realm
    # import, and a wrong health path would leave the Service with no endpoints.