From e098840fabb81c276f10f5520ff06b9cd6f8bf2a Mon Sep 17 00:00:00 2001 From: irl Date: Sun, 30 Nov 2025 15:02:51 +0000 Subject: [PATCH] feat(podman_keycloak): nginx enhancements (buffering + DNS) * lookup of the keycloak container is at runtime to allow for the keycloak container being restarted while nginx is running * increased buffer sizes to permit for larger signed SAML exchanges (was required for Google Workspace) --- roles/podman_keycloak/templates/nginx.conf | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/roles/podman_keycloak/templates/nginx.conf b/roles/podman_keycloak/templates/nginx.conf index c98d07c..d63f7de 100644 --- a/roles/podman_keycloak/templates/nginx.conf +++ b/roles/podman_keycloak/templates/nginx.conf @@ -1,5 +1,12 @@ # {{ ansible_managed }} +resolver 10.89.0.1 ipv6=off valid=10s; + +upstream keycloak { + zone keycloak_upstream 64k; + server keycloak:8080 resolve; +} + server { listen 80; listen [::]:80; @@ -28,12 +35,15 @@ server { ssl_certificate_key /etc/letsencrypt/live/{{ podman_keycloak_keycloak_hostname }}/privkey.pem; location / { - proxy_pass http://keycloak:8080/; + proxy_pass http://keycloak; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port 443; + proxy_buffer_size 128k; + proxy_buffers 4 256k; + proxy_busy_buffers_size 256k; } }