OIDC redirects to localhost

[kacper-uminski]

Hi!

I am attempting to set up rustical at my org and authenticate it via keycloak. The service is running behind a reverse proxy and in a docker compose environment with the following docker-compose.yaml:

services:
  rustical:
    image: ghcr.io/lennart-k/rustical
    ports:
      - 4000:4000
    volumes:
      - ./data:/var/lib/rustical/
      - ./config.toml:/etc/rustical/config.toml

And the following config.toml:

[data_store.sqlite]
db_url = "/var/lib/rustical/db.sqlite3"
run_repairs = true
skip_broken = true

[http]
bind = "[::]:4000"
session_cookie_samesite_strict = false
payload_limit_mb = 4

[frontend]
enabled = true
allow_password_login = false

[tracing]
opentelemetry = false

[dav_push]
enabled = true

[nextcloud_login]
enabled = false

[caldav]
rfc7809 = true

[oidc]
name = "MyOrg"
issuer = "https://login.myorg.org/realms/myorg"
client_id = "cal"
client_secret = "a_very_secret_string"
scopes = ["openid", "profile", "email"]
allow_sign_up = false

Signing in via keycloak works perfectly fine, but when the login succeeds it redirects to localhost:4000, which I assume is because of the bind config. Changing the bind to the website itself fails with an error 99, address unavailable.

Is there some way to specify a base url or some such? Also, sorry if I am missing something obvious. I am very new to both keycloak and rustical. :)

[lennart-k]

Hey, the origin for the redirect uri is determined by the HTTP Host header for which your browser uses the host from the current url.
So what I could imagine is that either your reverse proxy changes the Host header to something else
or you're accidentally trying to access rustical from the browser on localhost:4000 (which would be trivial to fix). :)

Which reverse proxy are you using and is there any special configuration in there?
Because I could imagine that some reverse proxies might change the Host header and instead store the origin in X-Forwarded-Host.

[kacper-uminski]

Ah, yeah. That fixed it. I am using nginx, and setting proxy_set_header Host $host; worked. Thanks a lot!

[lennart-k]

Nice, happy to hear that it worked :)