I have a docker container running keycloak v16 and I need to set HTTPS for it. I tried a nginx proxy and the site is available on port 8443 unless I try to open admin console, it redirects me to https://xxxxxx/auth/admin/ 443 port for some reason, as far as I understand
proxy_set_header X-Forwarded-Port “8443”;
should keep it on port 8443 and it works for another apps, but here I get 443 port and can’t get why. Any ideas?

nginx config:

server {
  server_name  xxxxxx;
  listen 8443 ssl;
  ssl_certificate /etc/nginx/ssl/xxxxxx.crt;
  ssl_certificate_key /etc/nginx/ssl/xxxxxx.key;
  access_log            /var/log/nginx/keycloak.access.log;
  error_log             /var/log/nginx/keycloak.error.log;

  proxy_read_timeout 3600;
#  client_max_body_size 1G;
    location / {
      # Use IPv4 upstream address instead of DNS name to avoid attempts by nginx to use IPv6 DNS lookup
      proxy_pass http://127.0.0.1:8016/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-Port "8443";
    }
}

docker-compose.yaml

version: "3.9"

services:
  keycloak:
    image: xxxxxx/misc/keycloak:16.1.1
    container_name: keycloak16
    restart: unless-stopped
    environment:
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: xxxxxx
      DB_VENDOR: postgres
      DB_ADDR: xxxxxx
      DB_DATABASE: keycloak
      DB_SCHEMA: keycloak16
      DB_USER: keycloak
      DB_PASSWORD: keycloak
    command:
    - '-Dkeycloak.profile.feature.token_exchange=enabled -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled'
    ports:
      - 8016:8080
    volumes:
      - /opt/keycloak/16/modules:/opt/jboss/keycloak/modules/system/layers/keycloak/ru/athena/cbs/main
      - /opt/keycloak/16/standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml
      - /opt/keycloak/16/standalone-ha.xml:/opt/jboss/keycloak/standalone/configuration/standalone-ha.xml