Deploy Keycloak on Your VPS
Deploy Keycloak on your VPS in one click. One login for everything you run — OpenID Connect and SAML single sign-on, users, roles, and MFA, backed by PostgreSQL.
Keycloak is the identity server behind a lot of corporate SSO. Instead of every app keeping its own password table, they all delegate to Keycloak: users, groups, roles, and permissions live in one place, and your apps speak OpenID Connect or SAML to it. It also handles multi-factor, self-service password reset, and login via Google, GitHub, or an existing LDAP or Active Directory.
Deployed with PostgreSQL, which holds every realm, user, and session — Keycloak itself keeps no state on disk. Sign in to the admin console with the credentials shown at deploy and create your first realm for your applications; the master realm is for administering Keycloak itself. The first boot takes a couple of minutes because Keycloak builds its runtime configuration before it starts serving.
What's included
- OpenID Connect and SAML 2.0 single sign-on for all your apps
- Users, groups, roles, and fine-grained permissions in one place
- Multi-factor auth, self-service password reset, and login brute-force detection
- Social login plus LDAP and Active Directory federation
- PostgreSQL-backed, with the public URL wired in so OIDC discovery is correct
Common use cases
- One company login across several internal tools
- Adding SSO and MFA to an app without building auth yourself
- Keeping employee or customer identity on infrastructure you control
Frequently asked questions
Why is the first start slow?
Keycloak builds its runtime configuration before it serves traffic, and without a pre-baked image that build happens on boot. Give it a couple of minutes on the first deploy; later restarts are quicker.
Do I use the master realm for my users?
No. The master realm exists to administer Keycloak itself. Create a realm for your application and put your users, clients, and roles there — that separation is what lets you hand out admin rights in one without giving away the other.
Will OIDC redirects work behind Vessl's HTTPS?
Yes. TLS terminates at the proxy and Keycloak is told both its public URL and to trust the forwarded headers, so its discovery document, token issuer, and redirects all use https. Getting that wrong is the classic self-hosted Keycloak headache; the template sets it for you.
Ready to ship?
Deploy Keycloak in under a minute.
Connect your VPS, pick this template, fill in any required fields. Vessl handles the container, SSL, and persistent storage.
Start for FreeNo credit card · BYOS · IDR billing