Example: 3-node HA cluster

The complete cluster definition for a production 3-node HA install — this is the only file you edit. Run ./configure -c examples/ha-3node.yml against it.

---
# keelinfra/keycloak cluster definition
# This is the only file you need to edit. Run:  ./configure -c examples/ha-3node.yml

cluster_name: keycloak-prod

# The three nodes. First node also hosts the backup repository,
# Prometheus, and Grafana. All nodes run Keycloak + PostgreSQL + etcd.
nodes:
  - host: 10.0.0.11
    name: kc-node1
  - host: 10.0.0.12
    name: kc-node2
  - host: 10.0.0.13
    name: kc-node3

# SSH connection for Ansible (agent or key-based; password auth not supported)
ssh_user: ubuntu
# ssh_private_key: ~/.ssh/id_ed25519   # optional, defaults to agent

# Public entrypoint. Users reach Keycloak at https://<domain>/
# Point DNS at the VIP (if enabled) or at any node / your external LB.
domain: sso.example.com

# Optional keepalived VIP shared by the three nodes (same L2 segment required).
# Leave empty to skip VIP and use an external load balancer or round-robin DNS.
vip: ""

# Keycloak version to install. Upgrades are driven by ./upgrade, not by editing this.
keycloak_version: "26.8.1"

# TLS: "selfsigned" generates a local CA and certs (good for eval/intranet).
# "custom" uses your own certificate for <domain>; ./configure checks that it
# is not expired, lists the domain, and matches the key. Paths are relative to
# this file. Traffic between the nodes is not encrypted yet.
tls_mode: selfsigned
# tls_cert_file: tls/sso.example.com.crt   # PEM: server certificate, then intermediates
# tls_key_file: tls/sso.example.com.key    # PEM private key, no passphrase
# tls_ca_file: tls/internal-ca.crt         # optional: private CA to trust on the nodes

# Off-site backup copy (optional, recommended for production). Without it,
# backups live only on the first node: lose that node's disk and you lose
# them too. With it, pgBackRest also keeps an encrypted copy in any
# S3-compatible bucket (AWS S3, or a self-hosted store). The access key is
# read from the environment when you run ./configure, never from this file:
#   KEELINFRA_S3_ACCESS_KEY=... KEELINFRA_S3_SECRET_KEY=... ./configure -c <this file>
# backup_s3:
#   endpoint: s3.eu-central-1.amazonaws.com   # host or host:port
#   region: eu-central-1
#   bucket: acme-keycloak-backups
#   uri_style: host          # "path" for most self-hosted stores
#   # path: /keycloak-prod   # optional, defaults to /<cluster_name>
#   # retention_full: 4      # optional, weekly full backups kept in the bucket
#   # ca_file: tls/s3-ca.crt # optional: private CA of a self-hosted store

# Where alerts go (optional). Without it, alerts are visible in Alertmanager
# and Grafana on the first node, but nobody is notified. Check delivery with
# ./verify --drill alert. The SMTP password, if any, comes from
# KEELINFRA_SMTP_PASSWORD when you run ./configure.
# alerting:
#   webhook_url: https://hooks.example.com/keycloak   # Alertmanager webhook JSON
#   email:
#     to: oncall@example.com
#     from: keycloak-alerts@example.com
#     smarthost: smtp.example.com:587
#     username: keycloak-alerts@example.com

Synced from keelinfra/keycloak/examples/ha-3node.yml @ d02cb0f — to change it, edit it there.