# ── Keycloak (shared identity provider — homekeeper realm lives here,
#    the gcnm app has its own separate realm): {{ keycloak_domain }} ─────────
server {
    listen 80;
    server_name {{ keycloak_domain }};
    # certbot --nginx adds SSL redirect + listen 443 block here

    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }
}