Keycloack in prod is stuck on loading admin page - nginx

Question

I have a keycloak server deployed with docker behind a nginx reverse proxy.
In dev mode all is working fine, but since I am trying to deploy it in prod I can acces the app but when I want to config my server from the admin console I'm stuck in this page :
Docker-compose
version: '3'
services:
postgresql:
image: postgres:latest
command: postgres -c 'max_connections=200'
networks:
- keycloak-net
- postgresql-net
restart: always
environment:
- POSTGRES_USER=keycloak
- POSTGRES_PASSWORD=password
- POSTGRES_DB=keycloak
volumes:
- ./keycloak/postgresql:/var/lib/postgresql/data
keycloak:
image: quay.io/keycloak/keycloak:20.0.3
networks:
- proxy-net
- keycloak-net
restart: always
command: start --spi-truststore-file-file /etc/x509/https/truststore.jks --spi-truststore-file-password password --spi-truststore-file-hostname-verification-policy ANY
environment:
- KC_HOSTNAME=keycloak
- KC_HOSTNAME_STRICT=false
- KC_PROXY=edge
- KC_HOSTNAME_STRICT_HTTPS=false
- KC_DB=postgres
- KC_DB_URL_HOST=postgresql
- KC_DB_URL_DATABASE=keycloak
- KC_DB_PASSWORD=password
- KC_DB_USERNAME=keycloak
- KC_DB_SCHEMA=public
- KEYCLOAK_ADMIN=admin
- KEYCLOAK_ADMIN_PASSWORD=password
depends_on:
- postgresql
volumes:
- ./keycloak/stores:/etc/x509/https
networks:
proxy-net:
external: true
keycloak-net:
driver: bridge
postgresql-net:
driver: bridge
Keycloak logs on startup
keycloak_1 | Next time you run the server, just run:
keycloak_1 |
keycloak_1 | kc.sh start --optimized --spi-truststore-file-file=/etc/x509/https/truststore.jks --spi-truststore-file-password=password --spi-truststore-file-hostname-verification-policy=ANY
keycloak_1 |
keycloak_1 | 2023-01-19 18:15:53,562 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: <unset>, Hostname: keycloak, Strict HTTPS: false, Path: <request>, Strict BackChannel: false, Admin URL: <unset>, Admin: <request>, Port: -1, Proxied: true
keycloak_1 | 2023-01-19 18:15:57,778 WARN [io.quarkus.agroal.runtime.DataSources] (main) Datasource <default> enables XA but transaction recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly
keycloak_1 | 2023-01-19 18:16:00,549 INFO [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener
keycloak_1 | 2023-01-19 18:16:00,555 WARN [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
keycloak_1 | 2023-01-19 18:16:00,658 WARN [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled
keycloak_1 | 2023-01-19 18:16:00,742 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller'
keycloak_1 | 2023-01-19 18:16:01,352 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000128: Infinispan version: Infinispan 'Triskaidekaphobia' 13.0.10.Final
keycloak_1 | 2023-01-19 18:16:01,673 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel `ISPN`
keycloak_1 | 2023-01-19 18:16:01,675 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000088: Unable to use any JGroups configuration mechanisms provided in properties {}. Using default JGroups configuration!
keycloak_1 | 2023-01-19 18:16:01,866 WARN [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
keycloak_1 | 2023-01-19 18:16:01,869 WARN [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 20.00MB, but the OS only allocated 212.99KB
keycloak_1 | 2023-01-19 18:16:01,870 WARN [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
keycloak_1 | 2023-01-19 18:16:01,872 WARN [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 25.00MB, but the OS only allocated 212.99KB
keycloak_1 | 2023-01-19 18:16:03,900 INFO [org.jgroups.protocols.pbcast.GMS] (keycloak-cache-init) 4b41e052f453-15754: no members discovered after 2003 ms: creating cluster as coordinator
keycloak_1 | 2023-01-19 18:16:03,933 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000094: Received new cluster view for channel ISPN: [4b41e052f453-15754|0] (1) [4b41e052f453-15754]
keycloak_1 | 2023-01-19 18:16:03,947 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000079: Channel `ISPN` local address is `4b41e052f453-15754`, physical addresses are `[192.168.16.3:54114]`
keycloak_1 | 2023-01-19 18:16:05,038 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: 4b41e052f453-15754, Site name: null
keycloak_1 | 2023-01-19 18:16:06,893 INFO [io.quarkus] (main) Keycloak 20.0.3 on JVM (powered by Quarkus 2.13.6.Final) started in 17.483s. Listening on: http://0.0.0.0:8080
keycloak_1 | 2023-01-19 18:16:06,897 INFO [io.quarkus] (main) Profile prod activated.
keycloak_1 | 2023-01-19 18:16:06,899 INFO [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, jdbc-mariadb, jdbc-mssql, jdbc-mysql, jdbc-oracle, jdbc-postgresql, keycloak, logging-gelf, narayana-jta, reactive-routes, resteasy, resteasy-jackson, smallrye-context-propagation, smallrye-health, smallrye-metrics, vault, vertx]
keycloak_1 | 2023-01-19 18:16:07,033 ERROR [org.keycloak.services] (main) KC-SERVICES0010: Failed to add user 'admin' to realm 'master': user with username exists
Note that the error at the end append beacause my db has already an admin.
I have the same issue when strating from an empty db.
nginx.conf
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name myserver.fr;
ssl_certificate /etc/nginx/ssl/live/myserver.fr/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/myserver.fr/privkey.pem;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
location / {
proxy_pass http://keycloak:8080;
}
}
Network console web browser
Thanks in advance for your help !
I have tried a lot of configuration, I saw a lot of time that adding KC_HOSTNAME_STRICT_HTTPS=false on env variable is the solution. I tried but it does not work..

Answer 1

With the help of #stdunbar I was able to solve this.
I had set KC_HOSTNAME to keycloak which is the hostname of the container in my docker network.
To solve my problem I set the KC_HOSTNAME to the real hostname accessible from browser : keycloak.mydomain.fr