Keycloak v25配置Traefik时多端口暴露异常问题求助

你的问题出在Traefik路由的匹配逻辑上，默认配置下无法区分主服务和健康检查的路径规则。以下是修正后的完整Docker Compose配置：

version: '3.3'
services:
  keycloak:
    image: quay.io/keycloak/keycloak:25.0.1
    volumes:
      - ./export:/tmp/export
      - ./export:/opt/keycloak/data/import
      - ./java.config:/etc/crypto-policies/back-ends/java.config
    environment:
      - *some env vars*
      - "KC_HEALTH_ENABLED=true"
    expose:
      - 8080
      - 9000
    networks:
      - web
    command: start-dev
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      
      # 主Keycloak路由（优先匹配非健康检查路径）
      - "traefik.http.routers.keycloak.entrypoints=https"
      - "traefik.http.routers.keycloak.rule=Host(`id.mydomain.com`) && !PathPrefix(`/health`)"
      - "traefik.http.routers.keycloak.priority=10"
      - "traefik.http.routers.keycloak.tls=true"
      - "traefik.http.routers.keycloak.tls.certresolver=letsEncrypt"
      - "traefik.http.services.keycloak-service.loadbalancer.server.port=8080"
      
      # 健康检查路由（仅匹配/health开头的路径）
      - "traefik.http.routers.keycloak-health.entrypoints=https"
      - "traefik.http.routers.keycloak-health.rule=Host(`id.mydomain.com`) && PathPrefix(`/health`)"
      - "traefik.http.routers.keycloak-health.priority=5"
      - "traefik.http.routers.keycloak-health.tls=true"
      - "traefik.http.routers.keycloak-health.tls.certresolver=letsEncrypt"
      - "traefik.http.services.keycloak-health-service.loadbalancer.server.port=9000"

networks:
  web:
    external: true

核心修改说明： #

1. 路径规则隔离：为主路由添加!PathPrefix(/health)规则，明确排除健康检查路径，避免请求被错误路由
2. 优先级设置：给主路由设置更高的priority值（10），确保Traefik优先匹配主服务的路由规则，健康路由优先级设为5，仅在匹配/health前缀时生效
3. 服务绑定校验：确保两个路由分别绑定到对应端口的服务，主路由对应8080端口的Keycloak主服务，健康路由对应9000端口的健康服务

修改完成后，访问id.mydomain.com会正常指向Keycloak主服务，id.mydomain.com/health、id.mydomain.com/health/live等健康端点会正确转发到9000端口的健康检查服务。

内容的提问来源于stack exchange，提问作者servusMori