Keycloak docker Administration Console shows blank page with reverse proxy - docker

Question

I am using HAProxy with Keycloak, welcome page is showing fine but each time I enter Administration Console it shows me a blank page with no info with status code 200.
I am using let's encrypt SSL certificate and here is my HAProxy config and docker-compose.
Screenshot of the page:-
link to screenshot
HAProxy config:-
global
log stdout local0 debug
daemon
maxconn 4096
defaults
mode http
option httplog
option dontlognull
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
log global
log-format {"type":"haproxy","timestamp":%Ts,"http_status":%ST,"http_request":"%r","remote_addr":"%ci","bytes_read":%B,"upstream_addr":"%si","backend_name":"%b","retries":%rc,"bytes_uploaded":%U,"upstream_response_time":"%Tr","upstream_connect_time":"%Tc","session_duration":"%Tt","termination_state":"%ts"}
frontend public
bind *:80
bind *:443 ssl crt /usr/local/etc/haproxy/haproxy.pem alpn h2,http/1.1
http-request redirect scheme https unless { ssl_fc }
default_backend web_servers
backend web_servers
option forwardfor
server auth1 auth:8080
docker-compose.yaml :-
version: "3"
networks:
internal-network:
services:
reverse-proxy:
build: ./reverse-proxy/.
image: reverseproxy:latest
ports:
- "80:80"
- "443:443"
networks:
- internal-network
depends_on:
- auth
auth:
image: quay.io/keycloak/keycloak:latest
networks:
internal-network:
environment:
PROXY_ADDRESS_FORWARDING: "true"
KEYCLOAK_USER: ***
KEYCLOAK_PASSWORD: ***
# Uncomment the line below if you want to specify JDBC parameters. The parameter below is just an example, and it shouldn't be used in production without knowledge. It is highly recommended that you read the PostgreSQL JDBC driver documentation in order to use it.
#JDBC_PARAMS: "ssl=false"
the URL to the page I am trying to access is https:///auth/admin/master/console/
Notes: when trying to remove SSL from HAProxy, the Keycloak opens a page with error "https required"

Answer 1

One obvious issue (there can be more issues, so fix of this one may still not fix everything):
https://www.keycloak.org/docs/latest/server_installation/index.html#_setting-up-a-load-balancer-or-proxy
Configure your reverse proxy or loadbalancer to properly set X-Forwarded-For and X-Forwarded-Proto HTTP headers.
You didn't configure this part in your haproxy frontend section. You need that:
http-request set-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-For %[src]
http-request set-header X-Forwarded-Proto https
Https protocol is required for OIDC, so "https required" is correct response, when you reach Keycloak via http protocol.