Install: 3-node HA

1. Describe your cluster

Copy and edit the 3-node example definition — hosts, SSH user, public domain, Keycloak version, TLS mode. It is the only file you edit; every field is documented in the configuration reference.

2. Configure and install

git clone https://github.com/keelinfra/keycloak && cd keycloak
./configure -c examples/ha-3node.yml   # validates nodes, generates inventory + vault
./install                              # ~10 minutes on 3 clean VMs

./configure writes a generated inventory under inventory/ (secrets go into an ansible-vault). ./install runs the playbooks: PostgreSQL + Patroni + etcd first, then Keycloak, HAProxy, TLS, backups, and monitoring.

3. First login

Open https://<your-domain>/admin. The bootstrap admin credentials are printed at the end of the install (and stored in the vault).

4. Point DNS

Point your domain at the keepalived VIP (if you set vip:), at any node, or at your external load balancer. With tls_mode: selfsigned, trust the generated local CA in your browser or switch to your own certificates — see TLS configuration.

5. Prove it

./verify                     # health of every component
./verify --drill session     # rolling restart; logins must survive

Run the full drill set before you put traffic on it — that's what it's for.