nginx/id.sa.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name id.${SA_PUBLIC_DOMAIN_NAME};

    location /auth/ {   # Gerrit adds this prefix for Keycloak...
        rewrite ^/auth(.*)$ $1 last;
    }

    location / {
        proxy_pass          http://keycloak:8080;
        proxy_set_header    X-Forwarded-For $remote_addr;
        proxy_set_header    Host $host;
    }
}