Исправлены ошибки в ходе раскатки

codebase/backend/nginx/docker-compose.yml

@@ -48,9 +48,9 @@ services:
     read_only: true
     tmpfs:
       - /tmp:size=128m,mode=1777
-      - /etc/nginx/generated:size=4m,mode=0755,uid=101,gid=101
+      - /etc/nginx/generated:size=4m,mode=0755,uid=0,gid=0
     cap_drop: ["ALL"]
-    cap_add: ["NET_BIND_SERVICE", "SETUID", "SETGID"]
+    cap_add: ["CHOWN", "NET_BIND_SERVICE", "SETUID", "SETGID"]
     security_opt: ["no-new-privileges:true"]
     extra_hosts:
       - "host.docker.internal:host-gateway"

codebase/backend/nginx/nginx.conf.template

@@ -1,3 +1,4 @@
+user nginx;
 worker_processes auto;
 pid /tmp/nginx.pid;
 error_log /dev/stderr warn;
@@ -11,6 +12,9 @@ http {
     default_type application/octet-stream;
     server_tokens off;
     charset utf-8;
+    proxy_connect_timeout 3s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
 
     map $http_upgrade $connection_upgrade {
         default upgrade;

codebase/backend/nginx/snippets/proxy-common.conf

@@ -11,6 +11,3 @@ proxy_hide_header X-Powered-By;
 proxy_hide_header Server;
 add_header X-Request-ID $edge_request_id always;
 include /etc/nginx/generated/security-headers.conf;
-proxy_connect_timeout 3s;
-proxy_send_timeout 30s;
-proxy_read_timeout 30s;

codebase/backend/nginx/snippets/proxy-keycloak.conf

@@ -0,0 +1,12 @@
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Forwarded-Proto https;
+proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Port 443;
+proxy_set_header X-Request-ID $edge_request_id;
+proxy_set_header traceparent $http_traceparent;
+proxy_hide_header X-Powered-By;
+proxy_hide_header Server;
+add_header X-Request-ID $edge_request_id always;

codebase/backend/nginx/templates/site-tls.conf.template

@@ -97,9 +97,17 @@ server {
         proxy_pass http://api_backend;
     }
 
-    location ^~ /auth/ {
+    location ^~ /auth/resources/ {
+        include /etc/nginx/snippets/proxy-keycloak.conf;
+        proxy_pass http://keycloak_upstream;
+    }
+    location ~ ^/auth/realms/[^/]+/protocol/openid-connect/3p-cookies/ {
+        include /etc/nginx/snippets/proxy-keycloak.conf;
+        proxy_pass http://keycloak_upstream;
+    }
+    location /auth/ {
         limit_req zone=auth burst=10;
-        include /etc/nginx/snippets/proxy-common.conf;
+        include /etc/nginx/snippets/proxy-keycloak.conf;
         proxy_read_timeout 60s;
         proxy_pass http://keycloak_upstream;
     }