问*44 connect()连接上游jhipster失败(111:连接被拒绝)

EN

version: '3.7'
services:
  keycloak:
    image: jboss/keycloak:10.0.2
    command:
      [
        '-b',
        '0.0.0.0',
        #'-Dkeycloak.forceBackendUrlToFrontendUrl=true',
        #'-Dkeycloak.frontendUrl=http://keycloak.t-vrec-ws-01/auth',
        '-Dkeycloak.migration.action=import',
        '-Dkeycloak.migration.provider=dir',
        '-Dkeycloak.migration.dir=/opt/jboss/keycloak/realm-config',
        '-Dkeycloak.migration.strategy=OVERWRITE_EXISTING',
        '-Djboss.socket.binding.port-offset=1000',
        '-Dkeycloak.profile.feature.upload_scripts=enabled',
      ]
    volumes:
      - ./realm-config:/opt/jboss/keycloak/realm-config
      - ./technet-certs/keycloak-technet.crt:/etc/x509/https/tls.crt
      - ./technet-certs/keycloak-technet.key:/etc/x509/https/tls.key
    environment:
#      - PROXY_ADDRESS_FORWARDING=true
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
      - DB_VENDOR=h2
    ports:
      - 80:9080
      - 9443:9443
      - 10990:10990
  gateway:
    image: gateway-cacert
    environment:
      - _JAVA_OPTIONS=-Xmx512m -Xms256m
      - 'SPRING_PROFILES_ACTIVE=prod,swagger'
      - 'SPRING_DATASOURCE_URL=jdbc:postgresql://gateway-postgresql:5432/gateway'
      - 'SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=https://keycloak.technet.local/auth/realms/jhipster'
        #- 'SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=https://gateway.t-vrec-ws-01/auth/realms/jhipster'
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=web-app
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=web-app
      - JHIPSTER_SLEEP=30
    ports:
      - 8443:443
    depends_on:
      - gateway-postgresql

  gateway-postgresql:
    image: postgres:12.3
    environment:
      - POSTGRES_USER=gateway
      - POSTGRES_PASSWORD=
      - POSTGRES_HOST_AUTH_METHOD=trust
    ports:
      - 5432:5432


  nginx:
    image: nginx
    depends_on:
      - gateway
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./nginx-ssl:/etc/nginx/ssl
    ports:
      - 443:443

events {
}

http {
   server {
         listen 443 ssl;

         server_name gateway.technet.local

         add_header Strict-Transport-Security "max-age=86400; includeSubdomains; preload" always;
         ssl_certificate /etc/nginx/ssl/nginx-selfsigned.crt;
         ssl_certificate_key /etc/nginx/ssl/nginx-selfsigned.key;
         ssl_session_timeout 20m;

         location /ag01 {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;

                proxy_pass https://gateway:443;
                resolver  127.0.0.1;
         }

         location /auth {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass https://keycloak:9443;
                resolver   127.0.0.1;
         }
   }
}