Production-grade self-hosted Keycloak. Proven nightly, in public.
keelinfra is an open-source (Apache-2.0) distribution that installs an HA Keycloak cluster — PostgreSQL with automatic failover, encrypted backups with PITR, monitoring, and tested upgrades — on your own VMs in ~10 minutes. Every supported upgrade path re-proves itself in public CI every night. Your data never leaves.
# three commands on clean Linux nodes — nothing pre-installed $ git clone https://github.com/keelinfra/keycloak && cd keycloak $ ./configure -c examples/ha-3node.yml $ ./install # ~10 minutes later: HA cluster + backups + monitoring
Everything Keycloak needs to survive production
Managed Keycloak vendors solve production by hosting your identity data on their cloud. If you can't or won't do that — regulated industry, data residency, air-gapped — the usual answer is "build it yourself." keelinfra is the third option: a distribution you run on your own machines, free and Apache-2.0, with the ops knowledge open instead of paywalled. How we compare →
HA Keycloak cluster
Multi-node, DB-persisted sessions, load-balanced, TLS everywhere. A node can die without logging anyone out.
PostgreSQL HA
Patroni-managed with automatic failover — writes keep flowing when the leader goes down.
Backups & PITR
pgBackRest, encrypted, scheduled — and restore-tested, because a backup you never restored is a rumor.
Tested upgrades
Rolling for patches, stop-start for minors. Every supported path re-runs nightly in public CI: install the old version, log in, upgrade — the pre-upgrade session must still refresh.
Observability
Prometheus + Grafana wired in, with alert rules for the things that actually page you.
Config as code
Realms, clients and roles managed declaratively via keycloak-config-cli. Git is the source of truth.
Don't take our word for it
Every claim on this page is a public CI run, a published probe log, or a drill you can run against your own cluster. The full ledger →
$ ./verify # health of every component $ ./verify --drill failover # switch the PostgreSQL leader over, write through it $ ./verify --drill restore # restore the latest backup to a scratch directory $ ./verify --drill session # rolling-restart every node; logins must survive
CI runs a clean install plus the session drill on every commit, and the upgrade matrix re-proves every supported upgrade path nightly.
Get Keycloak expertise on your side
Fixed-scope engagements on your infrastructure, delivered by the people who build the distribution. Every engagement ends with a written runbook your team keeps.
Deployment & HA hardening
Production HA deployment on your VMs or bare metal, drills run with your team, handover runbook.
Details →Migration & upgrades
Legacy / RH-SSO / managed-vendor → self-hosted, rehearsed on a staging copy before cutover.
Details →Emergency & expert help
Production down, upgrade gone wrong, split-brain. Root-cause analysis with a written post-mortem.
Details →Based in the EU · invoices with VAT · response within one business day. Not sure which fits? Describe your situation at hello@keelinfra.io and you'll get an honest answer — including "you don't need us" when you don't.
Measured, not promised
-
2026-09-01
Keycloak 26.7.3 fixes 20 CVEs. Here's which ones can actually reach you.
20 CVEs sounds like an emergency. We sorted all 20 by what has to be true for each to matter — plus the six non-security regressions living on 26.7.0-26.7.2 that the CVE count doesn't even cover — and mapped the tested path off both.
-
2026-08-26
Zero-downtime Keycloak patch upgrades, measured: 156/156 probes
We upgraded a 3-node HA Keycloak cluster while probing it every second: 156 probes, 156 × HTTP 200, and a pre-upgrade session that survived every node being replaced. The numbers, the orchestration, and the three mistakes we made.