website.testingspace.de
This page is served straight off disk by nginx. There is no authentication in front of it — anyone on the internet can read it.
How this one is wired
nginx terminates TLS and serves /srv/www/website directly.
No proxy, no session, no identity provider involved. This is the pattern
to copy for any service that should stay open to the public.
The other two service types
cloud.testingspace.de
Nextcloud. It speaks OIDC natively, so it redirects you to Keycloak on its own and nginx just proxies. Log in with the Keycloak button.
website-private.testingspace.de
A static site exactly like this one — but it has no idea what OIDC is. nginx checks every request against oauth2-proxy first, which handles the Keycloak login and only then lets the request through.
auth.testingspace.de
Keycloak — where users, groups and sessions actually live.