Keycloak

Run your own identity provider with a private PostgreSQL database.

Choose your deployment and the way you want to use Selfhost. The instructions below follow that choice.

Deployment Use Selfhost with

Set up Keycloak

Run your own identity provider with a private PostgreSQL database.

Customize deployment inputs (3)

Public identity hostname domain: hostnameDefault: "identity.example.com"
Local HTTP port behind your TLS proxy port: portDefault: 18080
Administrator email admin-email: emailDefault: "admin@example.com"

Save this as inputs.json and adjust the values before initialization.

{
  "domain": "identity.example.com",
  "port": 18080,
  "admin-email": "admin@example.com"
}

selfhost app --directory ./keycloak init keycloak --stack --inputs inputs.json

Initialization writes portable files and does not start the app. Review compose.yaml, the private .env and any files in files/, then start it:

selfhost app --directory ./keycloak start

No Selfhost dashboard or background service is needed. You can also start these files directly:

cd keycloak
docker compose -f compose.yaml up -d

Review the generated Compose and environment, then start the project.
Connect the loopback HTTP port to a local TLS proxy or a restricted SSH tunnel. The proxy must replace incoming forwarding headers. Use verified HTTPS for cross-server hops.
Sign in using the administrator email and ADMIN_PASSWORD from the project environment, then replace the bootstrap account with your own administrator.
Create an OIDC client with Authorization Code and PKCE. Register Selfhost's HTTPS /auth/callback URL, then add its realm issuer, client and your exact subject ID in Selfhost login settings.

Integrations for this deployment

This deployment has no attached native settings or onboarding profile. Follow its setup instructions above and use the app’s own administration interface. Choosing another deployment can expose different Selfhost integrations.

Versions and updates

This deployment uses the following images. Existing projects retain their saved recipe and images. A new catalogue version does not silently update them.

database: postgres:17-alpine
identity: quay.io/keycloak/keycloak:26.7.4

Review compatibility and back up app data before an update. Choose an image version and review the change.

Keep control of your setup

Selfhost remains optional. Your app runs using ordinary Compose files, its own settings and persistent data. Keep the Compose project name and volumes to preserve storage. Configuration exports and setting backups do not include application data.

Standalone CLI guide · Backups and removal