I have generated an app using jhipster, and trying to configure keycloak for production (I am testing it on my local machine first), but I am struggling enabling https, please notice I want to connect keycloak to a local postgres database available on my pc. When I am starting the docker compose file, I am always getting that I need to enable https. The certificated are both .pem, generated on windows openssl.
this is keycloak.yml file:
version: '3.8'
services:
keycloak:
image: quay.io/keycloak/keycloak:19.0.1
command: ['start', '--import-realm', '--hostname=localhost:9080', '--http-relative-path=/auth', '--https-port=9443']
# command: ['start', '--import-realm', '--hostname=localhost', '--https-port=9443']
# , '--hostname-strict-https=false'
volumes:
# the following line mounts the local realm config files into the keycloak container
- ./realm-config:/opt/keycloak/data/import
- ./keycloak-themes/new/custom:/opt/keycloak/themes/custom
- ./keycloak-themes/new/customKeycloak:/opt/keycloak/themes/customKeycloak
- ./spi/keycloak-ip-authenticator.jar:/opt/keycloak/providers/keycloak-ip-authenticator.jar
- ./spi/spi-registration-profile-0.0.1-SNAPSHOT.jar:/opt/keycloak/providers/spi-registration-profile-0.0.1-SNAPSHOT.jar
# the following line is used to export a realm config
- ./keycloak/realms/export:/tmp/export
- ./keycloak/certs:/etc/ssl/certs/certs
environment:
- DB_VENDOR=POSTGRES
- DB_ADDR=localhost:5432 # Replace with your external PostgreSQL host
- DB_DATABASE=my-keycloak-db # Replace with your database name
- DB_SCHEMA=public
- DB_USER=<user> # Replace with your PostgreSQL username
- DB_PASSWORD=<pass> # Replace with your PostgreSQL password
- KEYCLOAK_ADMIN=<admin>
- KEYCLOAK_ADMIN_PASSWORD=<pass>
- KEYCLOAK_USER=<user>
- KEYCLOAK_PASSWORD=<pass>
- KC_HTTPS_CERTIFICATE_FILE=/etc/ssl/certs/certs/localhostcert.pem
- KC_HTTPS_CERTIFICATE_key_FILE=/etc/ssl/certs/certs/localhostkey.pem
- KC_HTTPS_PORT=9443
ports:
# - 127.0.0.1:9080:9080
# - 127.0.0.1:9443:9443
- 8080:9080
- 9080:8080
- 9443:9443
- 443:8443
please let me know if anything missing although it could be outside the scope of the question