keycloak: Only expose recommended endpoints. Redirect main page to account page.

hosts/architect/keycloak.nix

@@ -33,11 +33,35 @@ in {
     nginx.virtualHosts.${domain} = {
       forceSSL = true;
       enableACME = true;
-      locations."/" = {
+
+      locations = {
+        "/" = { return = "301 https://${domain}/realms/master/account"; };
+        
+        "/js" = {
           proxyPass = "http://localhost:${
               toString config.services.keycloak.settings.http-port
             }";
         };
+
+        "/realms" = {
+          proxyPass = "http://localhost:${
+              toString config.services.keycloak.settings.http-port
+            }";
+        };
+
+        "/resources" = {
+          proxyPass = "http://localhost:${
+              toString config.services.keycloak.settings.http-port
+            }";
+        };
+
+        "/robots.txt" = {
+          proxyPass = "http://localhost:${
+              toString config.services.keycloak.settings.http-port
+            }";
+        };
+
+      };
     };
   };