Hardening for production

[john-gom]

• https://www.keycloak.org/server/configuration-production
• https://www.keycloak.org/docs/25.0.4/server_admin/#mitigating_security_threats

[john-gom]

Following through the list of items on https://www.keycloak.org/server/configuration-production:

• TLS for secure communication. Based on this decision we will not do this: docs: Internal security .github#37
• The hostname for Keycloak. Set through KC_HOSTNAME environment variable
• Reverse proxy in a distributed environment. This will require configuration of the current nginx proxy
• Limit the number of queued requests. Need to determine what the limits should be
• Production grade database. Already using PostgreSQL
• Support for Keycloak in a cluster. We are not doing this for other services at the moment so there would be no benefit in doing it for Keycloak
• Configure Keycloak Server with IPv4 or IPv6. Not sure why this is needed. Seems unnecessary