How to enabling HTTPS for keycloak behind nginx

I’m running Keycloak in a Docker container and have set up an Nginx reverse proxy to make it accessible at docsbot.agency. My current setup allows access via HTTP, but I need to enable HTTPS using an SSL certificate I have for the domain.

Currently, I launch Keycloak with the following command:

sudo docker run -d -p 8000:8080 \
    -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
    -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
    quay.io/keycloak/keycloak:26.0.7 start-dev

My Nginx configuration is as follows:

server {
    listen 80;
    server_name docsbot.agency;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

How can I modify my setup to correctly enable HTTPS? Should I configure Keycloak differently, or should I handle it entirely through Nginx?

Any guidance would be much appreciated!

Solution

To launch keycloak with https enabled, I used

docker run -d --name keycloak-prod \
  --network host \
  -v /home/cloud/certificates:/certificates \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=password \
  quay.io/keycloak/keycloak:latest \
  start \
  --features=token-exchange,hostname:v2 \
  --https-certificate-file=/certificates/cert.pem \
  --https-certificate-key-file=/certificates/key.pem \
  --hostname=https://your-domain.com \
  --proxy-headers=xforwarded \

After this configure nginx

server {
  listen 80;
  server_name your-domain.com;
  return 301 https://$host$request_uri;
}

server {
    listen               443 ssl;

    ssl                  on;

   ssl_certificate      /home/user/certificates/cert.pem;
   ssl_certificate_key  /home/user/certificates/key.pem;

    server_name your-domain.com;

    location / {
        proxy_pass https://127.0.0.1:8443; 
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}