Keycloak Server Deployment Overview¶

Prerequisites¶

The following system parameters are required for the application to function correctly:

• Operating System: Ubuntu.

• Access Rights: root privileges to manage Docker and system directories.

• Ports:

• 443 (external HTTPS port).

• 8080 (internal HTTP application port).

FQDN of the final panel on hostkey.in domain¶

Files and Directories Structure¶

The following directories are used in the system to store configurations, data, and certificates:

• /opt/keycloak — Keycloak application working directory.

• /root/nginx — Nginx reverse proxy management directory.

• /data/nginx/user_conf.d — Directory containing Nginx virtual host configuration files.

• /data/nginx/nginx-certbot.env — Environment variables file for Certbot.

Application Installation Process¶

Deployment is performed by running containers via Docker Compose. The application is installed in two stages:

1. Launching the main Keycloak stack and PostgreSQL database in the /opt/keycloak directory.

2. Deploying the Nginx reverse proxy with automatic SSL certificate acquisition via Certbot in the /root/nginx directory.

Docker Containers and Execution¶

Keycloak Application¶

Environment Variables:

• KC_BOOTSTRAP_ADMIN_USERNAME: root

• KC_BOOTSTRAP_ADMIN_PASSWORD: (set automatically)

• KC_HTTP_ENABLED: true

• KC_HOSTNAME: keycloak{Server_ID_from_Invapi}.hostkey.in

• KC_HOSTNAME_STRICT_HTTPS: false

• KC_PROXY_HEADERS: xforwarded

• KC_DB_URL: jdbc:postgresql://keycloak_postgres:5432/keycloak

• KC_DB: postgres

• KC_DB_USERNAME: keycloak

• KC_DB_PASSWORD: keycloak

Startup Command: start

PostgreSQL Database¶

Environment Variables:

• POSTGRES_DB: keycloak

• POSTGRES_USER: keycloak

• POSTGRES_PASSWORD: keycloak

• POSTGRES_PORT: 5432

Nginx Reverse Proxy (Certbot)¶

Volumes:

• nginx_secrets:/etc/letsencrypt

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d

Environment Variables:

• CERTBOT_EMAIL: [email protected]

Application Update¶

Updates are performed by executing the following commands:

docker compose pull && docker compose up -d

Permissions Settings¶

The following access rights are set to ensure security:

• Directory /opt/keycloak: owner root, group root, mode 0750.

• Configuration file keycloak-compose.yml: owner root, group root, mode 0640.

Location of Configuration Files and Data¶

• Docker Compose configuration (Keycloak): /opt/keycloak/keycloak-compose.yml

• Docker Compose configuration (Nginx): /root/nginx/compose.yml

• PostgreSQL database data: stored in the named volume postgres_data.

Available Connection Ports¶

• 443 — access to Keycloak interface via HTTPS (via Nginx proxy).

• 8080 — local application port (accessible only within the server via 127.0.0.1).

Starting and Stopping the Application¶

Container management is performed using Docker Compose commands:

For Keycloak:

docker compose -f /opt/keycloak/keycloak-compose.yml up -d  # Start
docker compose -f /opt/keycloak/keycloak-compose.yml down # Stop

For Nginx:

cd /root/nginx && docker compose up -d    # Start
cd /root/nginx && docker compose down     # Stop