haproxy setup for keycloak

defaults
        ...
        option forwardfor
        option http-server-close

frontend http
        bind *:80 alpn h2,http/1.1
        http-response set-header Strict-Transport-Security "max-age=16000000;"

        acl host_kc hdr(host) -i keycloak.demo.nethence.com
        redirect scheme https code 301 if host_kc

frontend https
        bind *:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
        http-response set-header Strict-Transport-Security "max-age=16000000;"

        acl host_kc hdr(host) -i keycloak.demo.nethence.com
        use_backend kc-server if host_kc

# @dnc-keycloak - 10.1.0.19:8080
backend kc-server
        #balance leastconn
        http-request set-header X-Forwarded-Proto https
        server dnc-keycloak 10.1.0.19:8080 check

works fine if you enforce http/2 also