生产环境Keycloak管理页面加载停滞问题求助

问题描述 #

我通过Docker部署Keycloak服务器，前端使用Nginx反向代理。开发模式下一切正常，但部署到生产环境后，虽能访问应用，却无法进入管理控制台——页面一直处于加载状态。

Docker-compose配置 #

version: '3'

services:
   postgresql:
     image: postgres:latest
     command: postgres -c 'max_connections=200'
     networks:
       - keycloak-net
       - postgresql-net
     restart: always
     environment:
       - POSTGRES_USER=keycloak
       - POSTGRES_PASSWORD=password
       - POSTGRES_DB=keycloak
     volumes:
       - ./keycloak/postgresql:/var/lib/postgresql/data


   keycloak:
     image: quay.io/keycloak/keycloak:20.0.3
     networks:
       - proxy-net
       - keycloak-net
     restart: always
     command: start --spi-truststore-file-file /etc/x509/https/truststore.jks --spi-truststore-file-password password --spi-truststore-file-hostname-verification-policy ANY
     environment:
       - KC_HOSTNAME=keycloak
       - KC_HOSTNAME_STRICT=false
       - KC_PROXY=edge
       - KC_HOSTNAME_STRICT_HTTPS=false
       - KC_DB=postgres
       - KC_DB_URL_HOST=postgresql
       - KC_DB_URL_DATABASE=keycloak
       - KC_DB_PASSWORD=password
       - KC_DB_USERNAME=keycloak
       - KC_DB_SCHEMA=public
       - KEYCLOAK_ADMIN=admin
       - KEYCLOAK_ADMIN_PASSWORD=password
     depends_on:
       - postgresql
     volumes:
       - ./keycloak/stores:/etc/x509/https

networks:
    proxy-net:
        external: true
    keycloak-net:
        driver: bridge
    postgresql-net:
        driver: bridge

Keycloak启动日志 #

keycloak_1     | Next time you run the server, just run:
keycloak_1     | 
keycloak_1     |        kc.sh start --optimized --spi-truststore-file-file=/etc/x509/https/truststore.jks --spi-truststore-file-password=password --spi-truststore-file-hostname-verification-policy=ANY
keycloak_1     | 
keycloak_1     | 2023-01-19 18:15:53,562 INFO  [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: <unset>, Hostname: keycloak, Strict HTTPS: false, Path: <request>, Strict BackChannel: false, Admin URL: <unset>, Admin: <request>, Port: -1, Proxied: true
keycloak_1     | 2023-01-19 18:15:57,778 WARN  [io.quarkus.agroal.runtime.DataSources] (main) Datasource <default> enables XA but transaction recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly
keycloak_1     | 2023-01-19 18:16:00,549 INFO  [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener
keycloak_1     | 2023-01-19 18:16:00,555 WARN  [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
keycloak_1     | 2023-01-19 18:16:00,658 WARN  [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled
keycloak_1     | 2023-01-19 18:16:00,742 INFO  [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller'
keycloak_1     | 2023-01-19 18:16:01,352 INFO  [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000128: Infinispan version: Infinispan 'Triskaidekaphobia' 13.0.10.Final
keycloak_1     | 2023-01-19 18:16:01,673 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel `ISPN`
keycloak_1     | 2023-01-19 18:16:01,675 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000088: Unable to use any JGroups configuration mechanisms provided in properties {}. Using default JGroups configuration!
keycloak_1     | 2023-01-19 18:16:01,866 WARN  [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
keycloak_1     | 2023-01-19 18:16:01,869 WARN  [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 20.00MB, but the OS only allocated 212.99KB
keycloak_1     | 2023-01-19 18:16:01,870 WARN  [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
keycloak_1     | 2023-01-19 18:16:01,872 WARN  [org.jgroups.protocols.UDP] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 25.00MB, but the OS only allocated 212.99KB
keycloak_1     | 2023-01-19 18:16:03,900 INFO  [org.jgroups.protocols.pbcast.GMS] (keycloak-cache-init) 4b41e052f453-15754: no members discovered after 2003 ms: creating cluster as coordinator
keycloak_1     | 2023-01-19 18:16:03,933 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000094: Received new cluster view for channel ISPN: [4b41e052f453-15754|0] (1) [4b41e052f453-15754]
keycloak_1     | 2023-01-19 18:16:03,947 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000079: Channel `ISPN` local address is `4b41e052f453-15754`, physical addresses are `[192.168.16.3:54114]`
keycloak_1     | 2023-01-19 18:16:05,038 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: 4b41e052f453-15754, Site name: null
keycloak_1     | 2023-01-19 18:16:06,893 INFO  [io.quarkus] (main) Keycloak 20.0.3 on JVM (powered by Quarkus 2.13.6.Final) started in 17.483s. Listening on: http://0.0.0.0:8080
keycloak_1     | 2023-01-19 18:16:06,897 INFO  [io.quarkus] (main) Profile prod activated. 
keycloak_1     | 2023-01-19 18:16:06,899 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, jdbc-mariadb, jdbc-mssql, jdbc-mysql, jdbc-oracle, jdbc-postgresql, keycloak, logging-gelf, narayana-jta, reactive-routes, resteasy, resteasy-jackson, smallrye-context-propagation, smallrye-health, smallrye-metrics, vault, vertx]
keycloak_1     | 2023-01-19 18:16:07,033 ERROR [org.keycloak.services] (main) KC-SERVICES0010: Failed to add user 'admin' to realm 'master': user with username exists

注：日志末尾的错误是因为数据库中已存在admin用户，即使从空数据库启动也会出现同样问题。

Nginx配置 #

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name myserver.fr;

    ssl_certificate /etc/nginx/ssl/live/myserver.fr/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/myserver.fr/privkey.pem;
        
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    
    location / {
        proxy_pass http://keycloak:8080;
    }
}

浏览器网络控制台截图 #

我尝试过多种配置，多次看到有人说添加KC_HOSTNAME_STRICT_HTTPS=false环境变量可解决，但对我无效，恳请各位提供帮助！

内容的提问来源于stack exchange，提问作者Armand D.