Keycloak Hosting: Your Own Single Sign-On Server

Keycloak is an open-source (Apache-2.0) identity and access management server. Your apps hand their login to it, and it handles users, passwords, two-factor and sessions in one place, so people sign in once and reach every app you connect. Choose it with a plan, pay, and we build the VPS (KVM, NVMe, Ubuntu 24.04 LTS) and install it in about four minutes after boot. You get:

• Keycloak 26.8.1 from the official image, in production mode with PostgreSQL 18 as its database, not the development setup with a built-in test database.
• Your admin account, permanent from the start. Keycloak's first start makes a temporary bootstrap admin; the install uses it once to create yours in the master realm and then deletes it, so the console shows no "temporary admin" warning. You log in with the user name and generated password shown in the Devoster dashboard.
• Self-registration off in the master realm, so nobody who finds the address can create an account.
• An HTTPS address like sso-k3x9a2.devoster.app with a Let's Encrypt certificate. Addresses start with sso- rather than the product name.
• Dashboard controls to open the admin console, reset the admin password, restart, stop or start it, read its logs, run an update and connect your own domain.

The app is free; you pay only the VPS plan, with 10% off yearly, and no per-user fee. The server comes with full root, free nightly backups kept 3 days plus one snapshot, a dedicated IPv4 and DDoS protection. Already have a Devoster VPS? You can install Keycloak on it from VPS Control, after the panel checks the OS, free ports 80/443 and disk, or reinstall the server with it, at no charge. Other apps that install this way are on the One-Click Apps page.

Open your address and go to the admin console at /admin. Everything in Keycloak lives in a realm: a separate set of users, groups, roles, login settings and connected apps (called clients).

• Keep the master realm for administration. Your admin account lives there and can manage every realm. Keycloak's own guidance is to create a separate realm for the people who log in to your apps.
• Create a realm for your users, then add users, groups and roles in it. Roles and group memberships can be sent to your apps in the login token, so each app can decide what someone may do.
• Two-factor sign-in is built in: authenticator apps (one-time codes) and WebAuthn security keys, which you can make optional or required per realm.
• Other identity sources: Keycloak can let people sign in with an external identity provider over OpenID Connect or SAML, such as a Google or GitHub account, and can read users from an LDAP or Active Directory server you already run.

Self-registration is off in the master realm. In your own realm you decide: leave it off and create accounts yourself, or switch on user registration in the realm's login settings if the public should be able to sign up.

Any app that supports OpenID Connect or SAML can use Keycloak for its login. Many self-hosted apps do, including Forgejo, Grafana and BookStack. For each app you create a client in your realm, set the redirect URL the app tells you, and copy the client ID and secret into the app's settings.

• The issuer URL of a realm is https://your-address/realms/your-realm, and apps that support discovery find everything else from it.
• Connect your own domain first. Keycloak builds every URL, including the issuer, from one public address. Once your domain is verified it becomes that address, and the devoster.app name redirects to it. Apps set up before the switch keep the old issuer in their settings and have to be updated, so add the domain from the dashboard (a CNAME or A record) before you connect apps.
• Your devices on a private network: if you'd rather your internal apps weren't public at all, a mesh VPN such as NetBird can connect them, while Keycloak stays reachable for logins.

Keycloak sends email for "Forgot password" links, address verification and some required actions. Outbound mail ports are blocked by default on Devoster VPS plans and no SMTP server is configured, so out of the box:

• Create users in the admin console and set a temporary password for each; Keycloak asks them to choose their own at first login. Don't turn on "Verify email" until mail works.
• Leave "Forgot password" off in your realm's login settings until mail works, so users aren't offered a link that never arrives. An admin can set a new password for anyone in the console.
• To send mail, enter your email provider's SMTP details in the realm's email settings and ask us to open its submission port; it is opened on request after approval.

Keycloak is a Java application, so memory matters more than CPU. The install sizes its Java heap to the plan, leaving room for PostgreSQL on the same server: about 512 MB on Micro, 1 GB on Starter and Basic, and 2 GB on Advanced.

In production mode Keycloak re-runs a short build step on every start, so a restart takes longer than for most apps. You can upgrade the plan from the panel later; the heap follows the new plan with the next update.

Updates: we check new Keycloak versions and apply them in a maintenance hour you choose, or when you press Update now. Keycloak migrates its database on the first start of a new version. A snapshot of the VPS is taken first, and if Keycloak doesn't come back healthy the server is rolled back automatically.

Locked out? Reset password in the Devoster dashboard uses Keycloak's own recovery command to set a new password for your admin account, and clears any brute-force lockout on it. Keycloak is stopped for a moment while it runs.

Backups: nightly backups (3 days) and your snapshot slot cover the whole VPS. For a copy you control, you can also export a realm's settings from the admin console.

The server is unmanaged: you have full root, and its security, your realms and your users are your responsibility. A login server is worth hardening; our VPS hardening checklist covers SSH keys and the firewall. Keycloak is an open-source project of the Cloud Native Computing Foundation; Devoster isn't affiliated with or endorsed by the project or the CNCF.