[{"data":1,"prerenderedAt":158},["ShallowReactive",2],{"seo-verification":3,"blog-keycloak-sso-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":20,"featuredImage":22,"bgImage":23,"posterImage":24,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":112,"ctaBody":113,"ctaButton":114,"ctaUrl":115,"relatedPosts":116},112,"keycloak-sso-vps","Deploy Keycloak for SSO on Your VPS","Deploy Keycloak on your VPS for enterprise-grade SSO: OIDC, SAML, realms and federation. A complete Docker guide and comparison.",8,744,false,"2026-02-28T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[21],{"id":11,"name":16,"slug":17,"color":18,"icon":19},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fkeycloak-sso-vps-poster.svg",{"categorySlug":26,"appSlug":27},"securite","keycloak","Keycloak is the open source reference for enterprise SSO, backed by Red Hat and used even in highly regulated environments. With its realms, LDAP federation and full support for OIDC and SAML, it covers needs that few IdPs can match. Self-hosted on a VPS, it gives you this level of industrialization without any licensing or cloud dependency.",[30,34,44,47,69,109],{"type":31,"title":32,"body":33},"h2","Why deploy Keycloak on your VPS","Where some IdPs aim for simplicity, Keycloak aims for completeness: multi-tenant isolation through realms, LDAP\u002FActive Directory directory federation, brokering to external providers (Google, GitHub, another OIDC), full theming of login pages and fine-grained authorization. For an agency managing several clients or an IT department with compliance requirements, this level of control is decisive. Self-hosting on a VPS spares you the per-user costs of managed IdP offerings and keeps the entire identity base under your jurisdiction, a critical point for sensitive data you would rather not entrust to a third party.",{"type":35,"title":36,"items":37},"ul","The strengths of a self-hosted Keycloak",[38,39,40,41,42,43],"Multiple realms to fully isolate several clients or environments on a single instance.","Native, complete support for OpenID Connect, OAuth2 and SAML 2.0.","LDAP \u002F Active Directory federation to reuse an existing directory without migration.","Identity brokering: sign-in via Google, GitHub or any external IdP in a few clicks.","Fully customizable login pages (themes, languages, per-realm branding).","Fine-grained authentication policies: conditional MFA, session duration, role-based constraints.",{"type":31,"title":45,"body":46},"Prerequisites for this deployment","Keycloak runs on the JVM (Quarkus since v17+) and remains more resource-hungry than a lightweight IdP. Plan for a VPS with at least 2 vCPUs and 4 GB of RAM, ideally 6 GB if you expect load or several active realms. An external PostgreSQL database is strongly recommended in production (never use the embedded H2 database beyond testing). Docker and Docker Compose, a dedicated domain (`sso.mydomain.com`) and a reverse proxy handling SSL round out the prerequisites, because Keycloak expects to be told that it is served behind an HTTPS proxy.",{"type":48,"title":49,"steps":50},"steps","Deploy Keycloak with PostgreSQL",[51,54,57,60,63,66],{"title":52,"body":53},"Define Keycloak and PostgreSQL in Compose","In your `docker-compose.yml`, declare the `postgres` service (image `postgres:16`) and the `keycloak` service (image `quay.io\u002Fkeycloak\u002Fkeycloak`). Connect Keycloak to the database via `KC_DB=postgres`, `KC_DB_URL`, `KC_DB_USERNAME` and `KC_DB_PASSWORD`.",{"title":55,"body":56},"Configure production mode and the proxy","Launch with the `start` command (not `start-dev`). Set `KC_HOSTNAME=sso.mydomain.com` and `KC_PROXY_HEADERS=xforwarded` so that Keycloak generates correct URLs behind the reverse proxy. Define the initial admin via `KC_BOOTSTRAP_ADMIN_USERNAME` \u002F `KC_BOOTSTRAP_ADMIN_PASSWORD`.",{"title":58,"body":59},"Start and complete the build","Run `docker compose up -d`. On first start, Keycloak performs an optimized Quarkus build and then migrates the PostgreSQL schema. Follow `docker compose logs -f keycloak` until the message indicating that the server is listening.",{"title":61,"body":62},"Set up the SSL reverse proxy","Route `sso.mydomain.com` to port `8080` of the Keycloak container via Caddy, Traefik or Nginx, with a Let's Encrypt certificate. Be sure to pass the `X-Forwarded-*` headers, otherwise login redirects will break.",{"title":64,"body":65},"Create a realm and a client","Log in to the admin console, create a dedicated realm (never the `master` realm for your apps), then an OIDC client. Set your application's `Valid redirect URIs` and retrieve the `Client ID` and secret in the Credentials tab.",{"title":67,"body":68},"Connect an application and test the flow","Configure your app with the discovery URL `https:\u002F\u002Fsso.mydomain.com\u002Frealms\u002Fmon-realm\u002F.well-known\u002Fopenid-configuration`. Create a test user in the realm, start a login and verify the token issuance in the console's Sessions.",{"type":70,"title":71,"headers":72,"rows":76},"comparison","Keycloak or Authentik: which to choose?",[73,74,75],"Criterion","Keycloak","Authentik",[77,81,85,89,93,97,101,105],[78,79,80],"Target use case","Enterprise SSO, multi-tenant, compliance","Self-hosting, homelab, agencies",[82,83,84],"Protocols","OIDC, OAuth2, SAML, LDAP","OIDC, OAuth2, SAML, LDAP, forward auth",[86,87,88],"Forward auth (proxy)","Not native (via extensions)","Native and central to the tool",[90,91,92],"Resource footprint","High (JVM, 4 GB+ RAM)","Moderate (2-4 GB RAM)",[94,95,96],"Multi-realm \u002F tenants","Excellent (isolated realms)","Tenants supported, less advanced",[98,99,100],"Flow customization","Themes and Java SPI","Visual step-based flows",[102,103,104],"Learning curve","Steep, very complete","More accessible",[106,107,108],"Directory federation","Mature (LDAP\u002FAD)","Good (LDAP)",{"type":110,"body":111},"tip","In production, never serve Keycloak with the embedded H2 database and never expose the `master` realm to the public: create a dedicated realm per application or per client, and reserve `master` for administration. To harden the instance, disable free registration, enable `brute force detection` in Realm Settings > Security Defenses, and provision everything via realm import files (`--import-realm`) so you version your configuration rather than clicking through the UI.","Host enterprise-grade SSO","The ServOrbit Cloud VPS with a preconfigured Docker template provides the RAM and PostgreSQL needed to run Keycloak in production, realms and federation included.","Deploy my Keycloak VPS","\u002Fvps-cloud",[117,131,145],{"id":118,"slug":119,"title":120,"excerpt":121,"readTime":122,"views":123,"isPinned":13,"publishedAt":124,"category":125,"categories":126,"featuredImage":22,"bgImage":23,"posterImage":128,"relatedSolution":129},105,"superviser-vps-uptime-kuma","Monitoring your VPS with Uptime Kuma","Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.",6,1520,"2026-03-07T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[127],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fsuperviser-vps-uptime-kuma-poster.svg",{"categorySlug":26,"appSlug":130},"uptime-kuma",{"id":132,"slug":133,"title":134,"excerpt":135,"readTime":136,"views":137,"isPinned":13,"publishedAt":138,"category":139,"categories":140,"featuredImage":22,"bgImage":23,"posterImage":142,"relatedSolution":143},106,"monitoring-vps-grafana-prometheus","VPS Monitoring with Grafana and Prometheus","Set up a Grafana + Prometheus stack on your VPS to collect, store and visualize your system and application metrics.",9,522,"2026-03-06T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[141],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitoring-vps-grafana-prometheus-poster.svg",{"categorySlug":26,"appSlug":144},"grafana",{"id":146,"slug":147,"title":148,"excerpt":149,"readTime":122,"views":150,"isPinned":13,"publishedAt":151,"category":152,"categories":153,"featuredImage":22,"bgImage":23,"posterImage":155,"relatedSolution":156},107,"monitorer-vps-netdata","Monitor your VPS in real time with Netdata","Install Netdata on your VPS for per-second real-time monitoring: thousands of metrics, zero configuration, alerts included.",559,"2026-03-05T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[154],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitorer-vps-netdata-poster.svg",{"categorySlug":26,"appSlug":157},"netdata",1785628453572]