Production-ready self-hosted Keycloak, in one command.

keelinfra packages what every team ends up building by hand: an HA Keycloak cluster, PostgreSQL with automatic failover, encrypted backups with PITR, monitoring — and the part nobody ships: upgrade paths that are actually tested. On your infrastructure. Your data never leaves.

View on GitHub Need help with Keycloak? → 
# three commands on clean Linux nodes — nothing pre-installed
$ git clone https://github.com/keelinfra/keycloak && cd keycloak
$ ./configure -c examples/ha-3node.yml
$ ./install        # ≈12 minutes later: HA cluster + backups + monitoring
156/156 probes OK
measured during a rolling patch upgrade — zero downtime, sessions intact
~16 s window
measured for a minor version upgrade — logged-in sessions survive the restart
1 command drills
failover, backup-restore and session-survival drills ship with the distribution
The distribution

Everything Keycloak needs to survive production

Keycloak is powerful; running it in production is not. Managed vendors solve this by hosting your identity data on their cloud. If you can't or won't do that — regulated industry, data residency, air-gapped — keelinfra is the third option: a distribution you run yourself, free and open source under Apache-2.0.

HA Keycloak cluster

Multi-node, DB-persisted sessions, load-balanced, TLS everywhere. A node can die without logging anyone out.

PostgreSQL HA

Patroni-managed with automatic failover — writes keep flowing when the leader goes down.

Backups & PITR

pgBackRest, encrypted, scheduled — and restore-tested, because a backup you never restored is a rumor.

Tested upgrades

Rolling for patches, stop-start for minors. Every supported path is executed end-to-end before we list it.

Observability

Prometheus + Grafana wired in, with alert rules for the things that actually page you.

Config as code

Realms, clients and roles managed declaratively via keycloak-config-cli. Git is the source of truth.

Services

Get Keycloak expertise on your side

Fixed-scope engagements on your infrastructure, delivered by the people who build the distribution. Every engagement ends with a written runbook your team keeps.

Deployment & HA hardening

from $3,000 fixed scope
  • Production HA deployment on your VMs or bare metal
  • PostgreSQL HA, backups/PITR, monitoring included
  • Failover & restore drills run with your team
  • Handover runbook + 30 days of email support
Get a quote

Migration & upgrades

from $5,000 fixed scope
  • Legacy / RH-SSO / managed-vendor → self-hosted
  • Multi-version upgrade paths, rehearsed on a staging copy
  • Session & realm integrity verified before cutover
  • Rollback plan you can actually execute
Get a quote

Emergency & expert help

$200/hour
  • Production down, upgrade gone wrong, cluster split-brain
  • Architecture & config review
  • Root-cause analysis with a written post-mortem
  • No retainer required
Email us

Based in the EU · invoices with VAT · response within one business day. Not sure which fits? Describe your situation at hello@keelinfra.io and you'll get an honest answer — including "you don't need us" when you don't.

Annual self-hosted subscription — early access

Per-node pricing (not per user): tested upgrade runbooks, CVE tracking, and direct access to the people who build keelinfra. Launching once the upgrade-matrix CI goes live.

Join the list
Status

An honest roadmap

We flip a row to working only after it has passed our own drills on real clusters — never before. Verified upgrade paths live in UPGRADES.md.

ComponentStatus
3-node HA installworking
PostgreSQL HA (Patroni, automatic failover)working
Backup / PITR (pgBackRest, restore-tested)working
Monitoring (Prometheus + Grafana + alerts)working
Tested upgrades (rolling patch / stop-start minor)working
Upgrade matrix in CI (every upstream release, automatically)in progress
Single-node installCI smoke only
Air-gapped bundleplanned