Dokku keycloak too many redirects

Question

I'm trying to run keycloak with dokku but i have a problem. keycloak works fine without TLS/SSL but when I'm creating ssl with letsencrypt. I'm getting too many redirects error. (ERR_TOO_MANY_REDIRECTS)

this is what I do:

//Pulling Keycloak image
docker pull image jboss/keycloak

//Adding dokku tag
docker image tag <keycloak-id> dokku/keycloak

dokku app:create keycloak

//Creating ENV variables for keycloak (im not using any database right now)
dokku config:set keycloak KEYCLOAK_USER=admin KEYCLOAK_PASSWORD=admin PROXY_ADDRESS_FORWARDING=false

//deploy using the tag i.e dokku/keycloak
dokku tags:deploy


dokku proxy:ports-add keycloak http:80:8080

//https://github.com/dokku/dokku-letsencrypt
dokku config:set --no-restart myapp DOKKU_LETSENCRYPT_EMAIL=your@email.tld
dokku letsencrypt keycloak


dokku proxy:ports-add keycloak https:443:8443
dokku proxy:ports-remove keycloak http:8080:8080 http:8443:8443 https:443:8080

this is nginx config for keycloak app:

    server {
  listen      [::]:80;
  listen      80;
  server_name keycloak.example.com;
  access_log  /var/log/nginx/keycloak-access.log;
  error_log   /var/log/nginx/keycloak-error.log;

  return 301 https://$host:443$request_uri;

}

server {
  listen      [::]:443 ssl http2;
  listen      443 ssl http2;

  server_name keycloak.example.com;
  access_log  /var/log/nginx/keycloak-access.log;
  error_log   /var/log/nginx/keycloak-error.log;

  ssl_certificate           /home/dokku/keycloak/tls/server.crt;
  ssl_certificate_key       /home/dokku/keycloak/tls/server.key;
  ssl_protocols             TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers off;

  keepalive_timeout   70;


  location    / {

    gzip on;
    gzip_min_length  1100;
    gzip_buffers  4 32k;
    gzip_types    text/css text/javascript text/xml text/plain text/x-component application/javascript application/x-javascript application/json application/xml  application/rss+xml font/truetype application/x-font-ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
    gzip_vary on;
    gzip_comp_level  6;

    proxy_pass  http://keycloak-8443;
    http2_push_preload on;
    proxy_http_version 1.1;
    proxy_read_timeout 60s;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Request-Start $msec;
  }
  include /home/dokku/keycloak/nginx.conf.d/*.conf;

  error_page 400 401 402 403 405 406 407 408 409 410 411 412 413 414 415 416 417 418 420 422 423 424 426 428 429 431 444 449 450 451 /400-error.html;
  location /400-error.html {
    root /var/lib/dokku/data/nginx-vhosts/dokku-errors;
    internal;
  }

  error_page 404 /404-error.html;
  location /404-error.html {
    root /var/lib/dokku/data/nginx-vhosts/dokku-errors;
    internal;
  }

  error_page 500 501 503 504 505 506 507 508 509 510 511 /500-error.html;
  location /500-error.html {
    root /var/lib/dokku/data/nginx-vhosts/dokku-errors;
    internal;
  }

  error_page 502 /502-error.html;
  location /502-error.html {
    root /var/lib/dokku/data/nginx-vhosts/dokku-errors;
    internal;
  }
}

upstream keycloak-8080 {

  server 172.17.0.2:8080;
}

upstream keycloak-8443 {

  server 172.17.0.2:8443;
}

and my app is running behind Cloudflare but im not using Cloudflare SSL or auto redirect to https. but when you configure your app to use letsencrypt plugin the plugin will automatically do that change to Nginx config and all the requests will redirect to SSL.

Answer 1

On the first look, it seems you are doing everything correctly. I am not sure about the port mappings and the IP address inside the nginx config file and also if it is deployed correctly.

I forked a keycloak-heroku sample into https://github.com/davidpodhola/keycloak-dokku and I am using it, so you can have a look. It has the nginx configuration file created on the fly from the template in the repo so it should always use the correct IP address.