docker - 我没有让 Keycloak 在 Traefik 后面的 docker 中工作

Question

我有一个域 example.org。

我有 docker 在那里运行，Traefik 作为代理。现在我想设置 Keycloak。我想访问 auth.example.org 上的 Keycloak。这是我的配置(docker-compose):

    keycloak:
        image: quay.io/keycloak/keycloak
        restart: always
        command: start
        environment:
            KC_PROXY_ADDRESS_FORWARDING: true
            KC_HOSTNAME_STRICT: false
            KC_HOSTNAME: auth.example.org
            KC_HOSTNAME_PORT: 443
            KC_HTTP_ENABLED: true
            KC_DB: postgres
            KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak?ssl=allow
            KC_DB_USERNAME: root
            KC_DB_PASSWORD: password
            KEYCLOAK_ADMIN: admin
            KEYCLOAK_ADMIN_PASSWORD: password
        labels:
            - "traefik.http.routers.cloud-network-keycloak.rule=Host(`auth.example.org`)"
            - "traefik.http.routers.cloud-network-keycloak.entrypoints=websecure"
            - "traefik.http.routers.cloud-network-keycloak.tls.certresolver=letsencryptresolver"
            - "traefik.http.routers.cloud-network-keycloak.tls=true"
            - "traefik.http.services.cloud-network-keycloak.loadbalancer.server.port=8080"
        depends_on:
            postgres:
                condition: service_healthy
        networks:
            - internal
            - traefik

但是，在 https://auth.example.org/admin/master/console/ 上加载 Keycloak 管理控制台会在浏览器中引发错误:

网址:https://auth.example.org/realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=security-admin-console&origin=https%3A%2F%2Fauth.example.org状态:403

我不知道...如何解决这个问题？

Answer 1

为了让 Keycloak 在端口 443 上正确响应，我需要删除 KC_HOSTNAME_PORT 配置，留下:

version: "3"

services:
  traefik:
    image: docker.io/traefik
    command:
      - --api.insecure=true
      - --providers.docker
      - --entrypoints.web.address=:80
      - --entrypoints.web-secure.address=:443
    ports:
      - "127.0.0.1:8080:8080"
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  keycloak:
    image: quay.io/keycloak/keycloak
    restart: always
    command: start
    environment:
      KC_PROXY_ADDRESS_FORWARDING: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME: auth.example.com
      KC_PROXY: edge
      KC_HTTP_ENABLED: "true"
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/$POSTGRES_DB?ssl=allow
      KC_DB_USERNAME: $POSTGRES_USER
      KC_DB_PASSWORD: $POSTGRES_PASSWORD
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: password
    labels:
      - "traefik.http.routers.cloud-network-keycloak.rule=Host(`auth.example.com`)"
      - "traefik.http.routers.cloud-network-keycloak.tls=true"
      - "traefik.http.services.cloud-network-keycloak.loadbalancer.server.port=8080"

  postgres:
    image: docker.io/postgres:14
    environment:
      POSTGRES_USER: $POSTGRES_USER
      POSTGRES_PASSWORD: $POSTGRES_PASSWORD
      POSTGRES_DB: $POSTGRES_DB

当我连接到它时，这对我来说没有错误 https://auth.example.com .如果我重新引入 KC_HOSTNAME_PORT设置，我得到了与您报告的相同的“无限纺车”你的问题。