. NGINX proxy rules aren't allowing internal calls

Sometimes the proxy_pass config blocks internal requests, especially if Keycloak only listens on its container IP and you’re hitting the domain from inside Docker.

3. Keycloak container doesn't know its external hostname

If Keycloak isn’t told about its external URL, it generates unreachable internal URLs.

You must set:

KC_HOSTNAME=auth.my-domain.com
KC_PROXY=edge

(Or the legacy KEYCLOAK_FRONTEND_URL depending on version.)

1. Internal DNS inside Docker can’t resolve the domain you're using

Locally, you might access Keycloak as:

http://keycloak:8080/realms/myrealm/.well-known/openid-configuration

But on the server you may be using:

https://auth.my-domain.com/realms/myrealm/.well-known/openid-configuration

And inside the container, DNS for auth.my-domain.com may resolve to the public IP, but NGINX may only be listening on localhost or behind Cloudflare, so the request loops until timeout.

http://keycloak:8080/realms/myrealm/.well-known/openid-configurationhttps://auth.my-domain.com/realms/myrealm/.well-known/openid-configurationhas anyone had domain resolution issues with oauth proxy when trying to fetch keycloak openid config info. it works fine locally but on the server and using nginx to serve keycloak when a domain is accessed, it times out. i tried to curl keycloak openif config url and noticed it timed out so im gueassing it used a similer methos to fetch data. Is this true or is there something i'm doing wrong or i can add to fix. I'm using docker images for both