diff --git a/keycloak/hooks/web_proxy-relation-joined b/keycloak/hooks/web_proxy-relation-joined
new file mode 100755
index 0000000..461a335
--- /dev/null
+++ b/keycloak/hooks/web_proxy-relation-joined
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+config-add "\
+services:
+  $MASTER_BASE_SERVICE_NAME:
+    environment:
+      PROXY_ADDRESS_FORWARDING: \"true\"
+"
+
diff --git a/keycloak/metadata.yml b/keycloak/metadata.yml
new file mode 100644
index 0000000..83b686e
--- /dev/null
+++ b/keycloak/metadata.yml
@@ -0,0 +1,14 @@
+docker-image: docker.0k.io/keycloak:16.1.1  ## jboss/keycloak:16.1.1
+
+default-options:
+
+uses:
+  web-proxy:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    constraint: recommended
+    auto: pair
+    solves:
+      proxy: "Public access"
+    default-options:
+      target: !var-expand ${MASTER_BASE_SERVICE_NAME}:8080