Missing Nginx resolver config causes 403 with "invalid response"

[jweisner]

$ curl -v https://www.example.com/
...
< HTTP/1.1 403 Forbidden
< Server: openresty/1.17.8.2
< Date: Thu, 01 Oct 2020 18:25:25 GMT
< Content-Type: application/octet-stream
< Transfer-Encoding: chunked
< Set-Cookie: session=redacted; Path=/; SameSite=Lax; HttpOnly
< Set-Cookie: redacted=redacted; path=/; HttpOnly; Secure
<
accessing discovery url (https://keycloak.example.com/auth/realms/web/.well-known/openid-configuration) failed: no resolver defined to resolve "keycloak.example.com"
* Connection #0 to host www.example.com left intact