• Keycloak
  • OpenJDK
  • PostgreSQL
  • NGINX

Keycloak VPS HostingSingle sign-on and identity on your own server

Keycloak is an open-source identity and access management server: single sign-on, OpenID Connect, SAML and user federation. We set it up on a hardened KVM VPS with PostgreSQL and NGINX with free SSL, so your users sign in through a server you control.

See VPS plans See how it deploys
  • KVM virtualisation
  • NVMe storage
  • Root SSH access
  • Free one-time setup
  • 99.9% uptime SLA

systemctl list-units --type=service --state=active

  • keycloakidentity server on localhost:8080
  • postgresqlproduction database
  • nginxHTTPS reverse proxy
  • ufwfirewall: 22, 80, 443
  • fail2banSSH brute-force guard
  • unattended-upgradessecurity updates

Installed and secured before handover.

:8080HTTP behind the proxy
:8443default HTTPS port
:9000management, never proxied
OIDC + SAMLstandard sign-in protocols
01Why a VPS

Why Self-Host Keycloak on a VPS

Hosted identity services charge per monthly active user. Keycloak on your own server has no per-user fee.

Open source, no per-user fee

Add users and apps as the server can serve them.

Standard protocols

OpenID Connect and SAML work with many apps.

One login, many apps

Single sign-on across your internal and public tools.

Data stays with you

Accounts and credentials are stored on your server.

02The stack

How a Keycloak Server Is Set Up

NGINX terminates HTTPS, Keycloak serves identity, PostgreSQL stores it.

  1. Reverse proxy

    NGINX

    HTTPS on your domain; exposes only what must be public.

  2. Identity server

    Keycloak

    Realms, clients, users and sessions.

  3. Database

    PostgreSQL

    A production-grade supported database.

  4. Runtime

    OpenJDK

    The Java version named in the Keycloak guide.

04 RUNTIME OpenJDK 03 DATABASE PostgreSQL 02 IDENTITY SERVER Keycloak 01 REVERSE PROXY NGINX

Engineer's notes

  1. Keycloak's guide names the OpenJDK version to install; use that one.
  2. Behind a proxy that ends TLS, enable HTTP and set the proxy headers option to xforwarded, or you may see 403 errors.
  3. Expose only /realms/, /resources/ and /.well-known/ publicly; keep the admin console internal.
  4. Do not proxy the management port 9000 or the metrics and health paths.
  • 443HTTPS, NGINX
  • 80HTTP, redirects to HTTPS
  • 22SSH, you only
  • 8080Keycloak, localhost only
03Use cases

What You Can Run

Single sign-on

One login for your web apps and internal tools.

OpenID Connect and OAuth 2

Sign in for modern web and mobile apps.

SAML

Connect apps that need SAML.

User federation

Connect existing user stores, such as LDAP.

Multi-factor authentication

Add a second factor to sign-ins.

Social login

Let users sign in with identity providers you configure.

04Sizing guide

Which Plan for Your Keycloak Server

Sign-in rate and the apps you connect decide the size.

Recommended start

VPS-1

2 vCores and 4 GB RAM.

vCores2
RAM4 GB
NVMe40 GB
See VPS-1
Recommended start

VPS-2

4 vCores and 8 GB RAM.

vCores4
RAM8 GB
NVMe75 GB
See VPS-2
Recommended start

VPS-3

6 vCores, 12 GB RAM and 100 GB NVMe.

vCores6
RAM12 GB
NVMe100 GB
See VPS-3
Recommended start

VPS-4

8 vCores, 24 GB RAM and 200 GB NVMe.

vCores8
RAM24 GB
NVMe200 GB
See VPS-4

A starting point, not a limit: every plan upgrades in place, keeping your data, IP address and configuration.

05After handover

Running Keycloak on Your Server

The steps below follow the Keycloak server guides. Check the current version on keycloak.org.

  1. Install Java and unpack Keycloak

    Use the OpenJDK version the guide names; download the release zip from keycloak.org.

    java -versionunzip keycloak-<version>.zip -d /opt

  2. Configure PostgreSQL and the proxy

    Environment variables for the database, hostname and proxy headers.

    export KC_DB=postgres KC_DB_URL=jdbc:postgresql://localhost/keycloakexport KC_HOSTNAME=https://auth.example.comexport KC_HTTP_ENABLED=true KC_PROXY_HEADERS=xforwarded

  3. Build and start

    Build, then start in production mode. Keycloak has no default admin: you create the first one on first visit.

    /opt/keycloak/bin/kc.sh build/opt/keycloak/bin/kc.sh start --optimized

  4. Run it as a service

    A systemd unit keeps Keycloak running and restarts it.

    sudo nano /etc/systemd/system/keycloak.servicesudo systemctl enable --now keycloak

Example commands: adjust names, paths and versions to your project. Deploying and maintaining your application is yours to do, or ask us for a quote.

06Cheat sheet

Keycloak commands you will use every week

Copy, paste, adjust the names. Each one is safe to run as your own user on the server.

Service status

sudo systemctl status keycloak

Restart after a change

sudo systemctl restart keycloak

Follow the log

sudo journalctl -u keycloak -f

Rebuild after a config change

/opt/keycloak/bin/kc.sh build

Check the listening port

ss -ltnp | grep 8080

Reload NGINX safely

sudo nginx -t && sudo systemctl reload nginx
07Compare

Hosted Identity or Your Own Keycloak?

A hosted service removes the operations. Your own Keycloak has no per-user fee and keeps accounts on your server.

Hosted identity

  • PricingPer monthly active user
  • Where accounts liveThe provider's cloud
  • CustomisationLimited by the provider
  • Upgrades and backupsHandled by the provider
  • Server administrationHandled by the provider

Keycloak VPS

  • PricingFlat server cost
  • Where accounts liveYour server
  • CustomisationThemes, providers and flows are yours
  • Upgrades and backupsYours: updates and extra backups
  • Server administrationYours, after our free setup
Choose a VPS plan
08Handover

Your Keycloak server

Free one-time setup before you get access. Here is what happens, and what you receive.

  1. Pick a plan and a location

    Resources that fit your workload, in the datacentre closest to your users.

  2. Tell us your Keycloak setup

    Versions, database and domain: at order or right after.

  3. We install and secure it

    Server hardened, the stack installed and tested, HTTPS on your domain.

  4. You get root

    SSH to a working server, ready for your code and data.

Installed for you

  • Keycloak and the OpenJDK it needs, running as a systemd service
  • PostgreSQL as the production database
  • NGINX reverse proxy with HTTPS on your domain
  • Realms, clients, users and themes are set up by you

Secured before handover

  • Non-root sudo user created for daily work
  • SSH key login, password login for root disabled
  • Firewall (UFW) open only for the ports you use
  • Fail2ban blocking repeated login attempts
  • Automatic security updates enabled
  • Free Let's Encrypt SSL on your domain
  • Timezone, swap and hostname configured

Not included (we say so up front)

  • Ongoing server administration
  • Application maintenance and updates
  • Debugging your code
  • Migrating existing sites or data
09Hardening and tuning

Security and Performance for Keycloak

Security

  • Use HTTPS everywhere and a real hostname.
  • Keep the admin console off the public internet.
  • Never run production on the development database.
  • Update Keycloak regularly: it handles credentials.

Performance

  • Use PostgreSQL on NVMe.
  • Give the JVM enough memory; do not share it with heavy apps.
  • Use the optimized start after a build.
  • Back up the PostgreSQL database as well as the daily VPS backups.

Built from the official documentation

VPS Plans

VPS Plans for Keycloak

Keycloak and PostgreSQL share the server. Start at VPS-2 and size up with users and sign-in volume.

VPS-1

Small websites, APIs, bots and development servers.

₹1,008 /mo
Get Started
  • 2 vCores
  • 4 GB RAM
  • 40 GB NVMe
  • 500 Mbps
  • Full root and SSH access
  • Free initial stack installation
  • Server hardening and firewall setup
  • Daily backup of the previous 24 hours
  • Unlimited traffic *
  • Anti-DDoS protection
  • Dedicated IPv4 and IPv6
  • KVM virtualisation
Most Popular

VPS-2

Production apps, WordPress and online stores.

₹1,906 /mo
Get Started
  • 4 vCores
  • 8 GB RAM
  • 75 GB NVMe
  • 1 Gbps
  • Full root and SSH access
  • Free initial stack installation
  • Server hardening and firewall setup
  • Daily backup of the previous 24 hours
  • Unlimited traffic *
  • Anti-DDoS protection
  • Dedicated IPv4 and IPv6
  • KVM virtualisation

VPS-3

Busy stores, SaaS products and several projects.

₹2,748 /mo
Get Started
  • 6 vCores
  • 12 GB RAM
  • 100 GB NVMe
  • 2 Gbps
  • Full root and SSH access
  • Free initial stack installation
  • Server hardening and firewall setup
  • Daily backup of the previous 24 hours
  • Unlimited traffic *
  • Anti-DDoS protection
  • Dedicated IPv4 and IPv6
  • KVM virtualisation

VPS-4

High-traffic apps, large databases and agencies.

₹5,274 /mo
Get Started
  • 8 vCores
  • 24 GB RAM
  • 200 GB NVMe
  • 3 Gbps
  • Full root and SSH access
  • Free initial stack installation
  • Server hardening and firewall setup
  • Daily backup of the previous 24 hours
  • Unlimited traffic *
  • Anti-DDoS protection
  • Dedicated IPv4 and IPv6
  • KVM virtualisation

* Unlimited traffic in Europe and North America. In Mumbai, Singapore and Sydney a monthly allowance applies (VPS-1 500 GB, VPS-2/VPS-3 1 TB, VPS-4 3 TB), then speed is limited to 10 Mbps until the next month.

Prices exclude 18% GST, which is added to invoices for customers in India.

10Under the hood

Platform specs and locations

The same KVM platform on every plan; only CPU, RAM, storage and port speed change.

Virtualisation
KVM with reserved vCores and RAM
Storage
NVMe SSD on every plan
Network
Dedicated IPv4 and IPv6, 500 Mbps to 3 Gbps per plan
Operating systems
Ubuntu 26.04, 24.04 and 22.04 LTS · Debian 13, 12 and 11 · AlmaLinux · Rocky Linux · Fedora · FreeBSD
Access
Full root over SSH, key-based login
Backups
Automatic daily backup of the previous 24 hours; snapshots and longer retention on request
Protection
Always-on anti-DDoS mitigation
Availability
99.9% uptime SLA

Asia-Pacific

  • Mumbai
  • Singapore
  • Sydney

Europe

  • London
  • Limburg
  • Roubaix
  • Gravelines
  • Strasbourg
  • Milan
  • Warsaw

North America

  • Beauharnois

Availability per location changes with demand; we confirm your location before setup. In Mumbai, Singapore and Sydney each plan includes a monthly traffic allowance (VPS-1 500 GB, VPS-2 and VPS-3 1 TB, VPS-4 3 TB); beyond it, speed is limited to 10 Mbps until the next month.

Keycloak VPS FAQs

Questions before you deploy

Not covered here? Ask an engineer before you order.

Ready when you are

Run Your Own Keycloak

Choose a plan and we hand over Keycloak on a hardened server with HTTPS on your domain.

Deploy your VPS Talk to an engineer