#!/usr/bin/env sh
set -eu

config=deploy/reverse-proxy/nginx-keycloak.conf
env_file=deploy/reverse-proxy/keycloak.env.example

grep -q 'proxy_set_header X-Forwarded-Host' "$config"
grep -q 'proxy_set_header X-Forwarded-Port 443' "$config"
grep -q 'proxy_set_header X-Forwarded-Proto https' "$config"
grep -q '^KC_PROXY_HEADERS=xforwarded$' "$env_file"
grep -q '^KC_HOSTNAME=https://' "$env_file"

docker run --rm \
  --add-host keycloak:127.0.0.1 \
  -v "$PWD/$config:/etc/nginx/conf.d/default.conf:ro" \
  nginx:1.29-alpine nginx -t

echo "Reverse-proxy header and Keycloak hostname contracts verified"