From 61730657e6ac3fb49844c280d02a10af38435c05 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 25 Sep 2026 10:40:46 +0200 Subject: [PATCH] fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177) KC_HOSTNAME_BACKCHANNEL_DYNAMIC builds the token/userinfo/certs URLs from the request, which reaches Keycloak as plain http through the proxy, so browsers blocked them as mixed content after login. Trust X-Forwarded-Proto. Co-Authored-By: Claude Opus 5.5 (1M context) --- infra/helm/big-reference/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/helm/big-reference/values.yaml b/infra/helm/big-reference/values.yaml index 1fb687f..2ef6cda 100644 --- a/infra/helm/big-reference/values.yaml +++ b/infra/helm/big-reference/values.yaml @@ -286,6 +286,11 @@ workloads: # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak # keeps its stock theme and the mounted big-demo theme is unused. KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}' + # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token, + # userinfo, certs — take their scheme from the request, which reaches Keycloak + # as plain http; trusting X-Forwarded-Proto keeps them https so the browser + # doesn't block them as mixed content. In-cluster calls send no such header. + KC_PROXY_HEADERS: xforwarded ports: [{ name: http, port: 8080 }] # TCP, not /health/ready on the management port: nothing here gates on realm # import, and a wrong health path would leave the Service with no endpoints. -- 2.54.0