Guide

1. Set up docker-compose.yml

version: '3'

volumes:
  postgres_data:
      driver: local

services:
  postgres:
      image: postgres:latest
      networks:
        - db
      volumes:
        - postgres_data:/var/lib/postgresql/data
      environment:
        POSTGRES_DB: keycloak
        POSTGRES_USER: keycloak
        POSTGRES_PASSWORD: <postgres_password>
  keycloak:
      image: jboss/keycloak:latest
      deploy:
        restart_policy:
          condition: always
          delay: 5s
          window: 120s
      networks:
        - web
        - db
      environment:
        DB_VENDOR: POSTGRES
        DB_ADDR: postgres
        DB_DATABASE: keycloak
        DB_USER: keycloak
        DB_SCHEMA: public
        DB_PASSWORD: <postgres_password>
        KEYCLOAK_USER: admin
        KEYCLOAK_PASSWORD: <keycloak_password>
        KC_HOSTNAME: <idp-hostname>
        PROXY_ADDRESS_FORWARDING: true
        KEYCLOAK_FRONTEND_URL: https://<idp-hostname>/auth
      depends_on:
        - postgres
  web:
    image: nginx
    networks:
      - web
    depends_on:
      - keycloak
    volumes:
     - ./web/nginx.conf:/etc/nginx/nginx.conf
     - ./certbot/www:/var/www/certbot/:ro
     - ./certbot/conf/:/etc/nginx/ssl/:ro
    ports:
     - "80:80"
     - "443:443"
    environment:
     - NGINX_PORT=80
  certbot:
    image: certbot/certbot:latest
    volumes:
     - ./certbot/www/:/var/www/certbot/:rw
     - ./certbot/conf/:/etc/letsencrypt/:rw

networks:
  web: {}
  db: {}

Replace <idp-hostname>, <keycloak-password> and <postgres_password>. Preferably store them securely.

2. Run initial nginx server

This step is needed in order to generate Let’s encrypt certificate with certbot before running actual Keycloak server.

Place this file in web/nginx.conf (relative to your docker-compose.yml file).

worker_processes  5;  ## Default: 1
worker_rlimit_nofile 8192;

events {
  worker_connections  4096;  ## Default: 1024
}

http {
  index    index.html index.htm index.php;
  default_type application/octet-stream;
  log_format   main '$remote_addr - $remote_user [$time_local]  $status '
    '"$request" $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
  sendfile     on;
  tcp_nopush   on;
  server_names_hash_bucket_size 128; # this seems to be required for some vhosts

  server { # Required for certbot
    server_name idp;
    listen       80;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

  }
}

3. Run certbot

docker-compose up -d web
docker-compose run --rm  certbot certonly --webroot --webroot-path /var/www/certbot/ -d <idp-hostname>

4. Configure Nginx

Now add Keycloak behind Nginx. Add this to your web/nginx.conf file. Again, replace <idp-hostname> with your own.

...

server {
    listen 443 default_server ssl http2;
    listen [::]:443 ssl http2;

    server_name <idp-hostname>;

    ssl_certificate /etc/nginx/ssl/live/<idp-hostname>/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/<idp-hostname>/privkey.pem;
    location /auth/admin/ {
      allow 127.0.0.1; # Only allow localhost to access admin, or change this to your IP-address
      deny all;
      proxy_pass      http://keycloak:8080/auth/admin/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
    location /auth/js/ {
      proxy_pass      http://keycloak:8080/auth/js/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
    location /auth/realms/ {
      proxy_pass      http://keycloak:8080/auth/realms/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_buffer_size          128k;
      proxy_buffers              4 256k;
      proxy_busy_buffers_size    256k;
    }
    location /auth/resources/ {
      proxy_pass      http://keycloak:8080/auth/resources/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
    location /auth/robots.txt {
      proxy_pass      http://keycloak:8080/auth/robots.txt;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
}

5. Start everything

docker-compose restart web
docker-compose up -d postgres keycloak

Now you should be able to access Keycloak at https://<idp-hostname>/auth

Markus

Configuring Keycloak in 2022