ahus1 · Oct 20, 2026
@@ -9,6 +9,7 @@ summary="Configure and start {project_name}.">
 
 This {section} explains the configuration methods for {project_name} and how to start and apply the preferred configuration. It includes configuration guidelines for optimizing {project_name} for faster startup and low memory footprint.
 
+[#_configuring_sources_for_keycloak]
 == Configuring sources for {project_name}
 {project_name} loads the configuration from four sources, which are listed here in order of application.
 
@@ -44,7 +45,7 @@ Based on the priority of application, the value that is used at startup is `cliV
 
 If `--db-url=cliValue` had not been used, the applied value would be `KC_DB_URL=envVarValue`. If the value were not applied by either the command line or an environment variable, `db-url=confFileValue` would be used. If none of the previous values were applied, the value `kc.db-url=keystoreValue` would be used due to the lowest priority among the available configuration sources.
 
-{project_name} configuration options often map to lower-level Quarkus or spi options. We refer to these as first-class and second-class configuration respectively. 
+{project_name} configuration options often map to lower-level Quarkus or spi options. We refer to these as first-class and second-class configuration respectively.
 There are startup warnings to indicate if you are using a second-class option. For example if you try to directly use `quarkus.http.port`, you will be warned to use `kc.http-port` instead.
 
 == Formats for configuration
@@ -132,7 +133,7 @@ When the KeyStore is created, you can start the server using the following param
 
 === Format for raw Quarkus properties
 In most cases, the available configuration options should suffice to configure the server.
-However, for a specific behavior or capability that is missing in the {project_name} configuration, you can use properties from the underlying Quarkus framework. If possible, avoid using properties directly from Quarkus, because they are unsupported by {project_name}. 
+However, for a specific behavior or capability that is missing in the {project_name} configuration, you can use properties from the underlying Quarkus framework. If possible, avoid using properties directly from Quarkus, because they are unsupported by {project_name}.
 
 <@profile.ifCommunity>
 If your need is essential, consider opening an https://github.com/keycloak/keycloak/issues/new?assignees=&labels=kind%2Fenhancement%2Cstatus%2Ftriage&template=enhancement.yml[enhancement request] first. This approach helps us improve the configuration of {project_name} to fit your needs.

@@ -313,6 +313,7 @@ Same risks as other tracing headers.
 
 |===
 
+[#_exposed_path_recommendations]
 === Exposed path recommendations
 
 When using a reverse proxy, {project_name} only requires certain paths to be exposed.

@@ -171,7 +171,7 @@ This is the externally trusted certificate that browsers verify.
 <3> The public certificates of each {project_name} backend server.
 Traefik verifies each backend server's TLS certificate against these entries, ensuring the connection goes to a trusted {project_name} instance and not an impersonator.
 <4> To remove an HTTP header from requests forwarded to {project_name}, define a key-value entry in `customRequestHeaders` where the key is the name of the HTTP header and the value is an empty string to indicate the header should be removed.
-Removing specific HTTP headers prevents external clients from spoofing proxy identity headers (such as `Forwarded`, `X-Forwarded-*`, and `X-Real-IP`), injecting authentication-related headers (such as `X-Forwarded-Access-Token`), or injecting distributed tracing context (such as W3C Trace Context, Zipkin B3, or Jaeger headers).
+Removing specific HTTP headers prevents external clients from spoofing proxy identity headers (such as `Forwarded`, `+X-Forwarded-*+`, and `X-Real-IP`), injecting authentication-related headers (such as `X-Forwarded-Access-Token`), or injecting distributed tracing context (such as W3C Trace Context, Zipkin B3, or Jaeger headers).
 Unlike HAProxy, Traefik does not support regex-based header matching, so each header variant must be listed explicitly.
 For the full list of recommended headers to filter, see the <@links.server id="reverseproxy" anchor="header-filtering-recommendations"/> {section}.
 <5> Restricts access so that only public {project_name} paths are reachable from external networks.
@@ -197,8 +197,8 @@ With TLS re-encrypt, {project_name} requires the following configuration:
 <@kc.start parameters="--proxy-headers xforwarded --health-enabled true --metrics-enabled true --https-certificate-file=/path/to/certificate --https-certificate-key-file=/path/to/key --https-client-auth=required --https-trust-store-file=/path/to/https-truststore --https-management-client-auth=none"/>
 
 `--proxy-headers xforwarded`::
-Instructs {project_name} to read the client IP address and protocol from the `X-Forwarded-*` headers set by Traefik.
-In re-encrypt mode, Traefik overwrites any incoming `X-Forwarded-*` headers with the correct client values before forwarding requests to {project_name}, preventing clients from injecting misleading header values.
+Instructs {project_name} to read the client IP address and protocol from the `+X-Forwarded-*+` headers set by Traefik.
+In re-encrypt mode, Traefik overwrites any incoming `+X-Forwarded-*+` headers with the correct client values before forwarding requests to {project_name}, preventing clients from injecting misleading header values.
 Do not set `--proxy-protocol-enabled` when using TLS re-encrypt.
 The PROXY protocol is only relevant for TLS passthrough (TCP mode).
-Original file line number
+Diff line change
@@ Expand Up / @@ -313,6 +313,7 @@ Same risks as other tracing headers. @@
     |===
+    [#_exposed_path_recommendations]
     === Exposed path recommendations
     When using a reverse proxy, {project_name} only requires certain paths to be exposed.
@@ Expand Down @@