hopu/keycloak

Keycloak 6.0.0（基础路径为/keycloak/auth）

镜像概述

本镜像基于官方Keycloak 6.0.0版本构建，通过修改核心配置文件将默认访问路径从/auth调整为/keycloak/auth，保持与官方版本功能一致的同时，满足自定义路径需求。

核心功能与特性

• 基于官方Keycloak 6.0.0稳定版本
• 修改基础访问路径为/keycloak/auth，避免默认路径冲突
• 调整独立模式(standalone.xml)和高可用模式(standalone-ha.xml)配置文件
• 更新欢迎页面(index.html)中的路径引用
• 支持官方Keycloak所有标准环境变量和配置选项

使用场景

• 需要在同一域名下部署多个服务时避免路径冲突
• 企业内部系统整合，需统一应用路径命名规范
• 特定网络环境要求自定义应用访问路径的场景

使用方法与配置说明

Dockerfile构建说明

本镜像通过以下Dockerfile修改官方镜像实现路径调整：

dockerfile
FROM jboss/keycloak:6.0.0
USER jboss
RUN sed -i -e 's/<web-context>auth<\/web-context>/<web-context>keycloak\/auth<\/web-context>/' $JBOSS_HOME/standalone/configuration/standalone.xml
RUN sed -i -e 's/<web-context>auth<\/web-context>/<web-context>keycloak\/auth<\/web-context>/' $JBOSS_HOME/standalone/configuration/standalone-ha.xml
RUN sed -i -e 's/name="\/"/name="\/keycloak\/"/' $JBOSS_HOME/standalone/configuration/standalone.xml
RUN sed -i -e 's/name="\/"/name="\/keycloak\/"/' $JBOSS_HOME/standalone/configuration/standalone-ha.xml
RUN sed -i -e 's/\/auth/\/keycloak\/auth"/' $JBOSS_HOME/welcome-content/index.html

Docker Compose部署示例

以下是使用PostgreSQL数据库的完整部署配置：

yaml
version: '3.3'

services:
  keycloak:
    image: hopu/keycloak:6.0.0
    ports:
      - 8180:8080
    environment:
      - KEYCLOAK_USER=keycloak          # Keycloak管理员用户名
      - KEYCLOAK_PASSWORD=keycloak      # Keycloak管理员密码
      - DB_VENDOR=postgres              # 数据库类型
      - DB_ADDR=keycloak-db             # 数据库地址
      - DB_PORT=5432                    # 数据库端口
      - DB_DATABASE=keycloak            # 数据库名称
      - DB_USER=keycloak                # 数据库用户名
      - DB_PASSWORD=keycloak            # 数据库密码
      - ROOT_LOGLEVEL=DEBUG             # 日志级别
      - PROXY_ADDRESS_FORWARDING=true   # 启用代理地址转发
    networks:
      - keycloak-gatekeeper-network

networks:
  keycloak-gatekeeper-network:
    external: true

Nginx反向代理配置

为使Keycloak通过/keycloak/auth路径正常访问，需配置Nginx反向代理：

nginx
map $http_upgrade $connection_upgrade {
    default         upgrade;
    ''              close;
}

server {
    listen                  80;
    server_name             example.local;

    location /keycloak/ {
        proxy_pass              http://keycloak:8080/;
        proxy_http_version      1.1;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         $connection_upgrade;
        proxy_set_header        Host               $host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Host   $host;
        proxy_set_header        X-Forwarded-Server $host;
        proxy_set_header        X-Forwarded-Port   $server_port;
        proxy_set_header        X-Forwarded-Proto  $scheme;
    }

    location /keycloak/auth/ {
        proxy_pass              http://keycloak:8080/keycloak/auth/;
        proxy_http_version      1.1;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         $connection_upgrade;
        proxy_set_header        Host               $host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Host   $host;
        proxy_set_header        X-Forwarded-Server $host;
        proxy_set_header        X-Forwarded-Port   $server_port;
        proxy_set_header        X-Forwarded-Proto  $scheme;
    }
}

Nginx Docker Compose配置

部署Nginx反向代理的docker-compose配置：

yaml
version: '3.3'

services:
  reverse_proxy:
    image: nginx:1.17.3
    ports:
     - target: 80
       published: 80
       protocol: tcp
       mode: host
    configs:
      - source: proxy-conf
        target: /etc/nginx/conf.d/proxy.conf
    networks:
      keycloak-gatekeeper-network:
        aliases:
          - example.local

configs:
  proxy-conf:
    file: ./proxy.nginx

networks:
  keycloak-gatekeeper-network:
    external: true