Hardening for production

[john-gom]

• https://www.keycloak.org/server/configuration-production
• https://www.keycloak.org/docs/25.0.4/server_admin/#mitigating_security_threats

[john-gom]

Following through the list of items on https://www.keycloak.org/server/configuration-production:

• [x] TLS for secure communication. Based on this decision we will not do this: https://github.com/openfoodfacts/.github/pull/37
• [x] The hostname for Keycloak. Set through KC_HOSTNAME environment variable
• [ ] Reverse proxy in a distributed environment. This will require configuration of the current nginx proxy
• [ ] Limit the number of queued requests. Need to determine what the limits should be
• [x] Production grade database. Already using PostgreSQL
• [x] Support for Keycloak in a cluster. We are not doing this for other services at the moment so there would be no benefit in doing it for Keycloak
• [x] Configure Keycloak Server with IPv4 or IPv6. Not sure why this is needed. Seems unnecessary