fix: proxy.headers xforwarded not forwarded - Traefik sends X-Forwarded-* headers

Keycloak was seeing requests as non-secure (HTTP) because it was expecting the RFC 7239 Forwarded: header but Traefik sends X-Forwarded-Proto/For/Host. This caused CSP failures and cookie security warnings.
2026-05-11 00:27:13 +01:00
parent 716ad61115
commit a2036c8381
1 changed files with 1 additions and 1 deletions
@@ -42,7 +42,7 @@ spec:

  # ── Proxy: trust forwarded headers from Traefik ──────────────────────────
  proxy:
-    headers: forwarded
+    headers: xforwarded

  # ── Bootstrap admin credentials (sealed secret — see admin.sealed.secret.yaml)
  bootstrapAdmin: