Example: single node

The complete cluster definition for a single-node install (no HA — evaluation, dev, or small internal setups). Run ./configure -c examples/single-node.yml against it.

---
# keelinfra/keycloak cluster definition — single node.
# Run:  ./configure -c examples/single-node.yml
#
# One machine running the full stack: Keycloak, PostgreSQL, backups,
# monitoring. No HA — fine for evaluation, dev, or small internal setups.
# Growing to 3 nodes later means a fresh 3-node install + realm import,
# so start with examples/ha-3node.yml if HA is where you're headed.

cluster_name: keycloak-single

nodes:
  - host: 10.0.0.11
    name: kc-node1

# SSH connection for Ansible (agent or key-based; password auth not supported)
ssh_user: ubuntu
# ssh_private_key: ~/.ssh/id_ed25519   # optional, defaults to agent

# Public entrypoint. Users reach Keycloak at https://<domain>/
domain: sso.example.com

# No VIP on a single node.
vip: ""

# Keycloak version to install. Upgrades are driven by ./upgrade, not by editing this.
keycloak_version: "26.8.1"

# TLS: "selfsigned" generates a local CA and certs (good for eval/intranet).
# "custom" uses your own certificate for <domain>; ./configure checks that it
# is not expired, lists the domain, and matches the key. Paths are relative to
# this file. Traffic between the nodes is not encrypted yet.
tls_mode: selfsigned
# tls_cert_file: tls/sso.example.com.crt   # PEM: server certificate, then intermediates
# tls_key_file: tls/sso.example.com.key    # PEM private key, no passphrase
# tls_ca_file: tls/internal-ca.crt         # optional: private CA to trust on the nodes

# Off-site backup copy (optional, recommended for production). Without it,
# backups live only on the first node: lose that node's disk and you lose
# them too. With it, pgBackRest also keeps an encrypted copy in any
# S3-compatible bucket (AWS S3, or a self-hosted store). The access key is
# read from the environment when you run ./configure, never from this file:
#   KEELINFRA_S3_ACCESS_KEY=... KEELINFRA_S3_SECRET_KEY=... ./configure -c <this file>
# backup_s3:
#   endpoint: s3.eu-central-1.amazonaws.com   # host or host:port
#   region: eu-central-1
#   bucket: acme-keycloak-backups
#   uri_style: host          # "path" for most self-hosted stores
#   # path: /keycloak-prod   # optional, defaults to /<cluster_name>
#   # retention_full: 4      # optional, weekly full backups kept in the bucket
#   # ca_file: tls/s3-ca.crt # optional: private CA of a self-hosted store

# Where alerts go (optional). Without it, alerts are visible in Alertmanager
# and Grafana on the first node, but nobody is notified. Check delivery with
# ./verify --drill alert. The SMTP password, if any, comes from
# KEELINFRA_SMTP_PASSWORD when you run ./configure.
# alerting:
#   webhook_url: https://hooks.example.com/keycloak   # Alertmanager webhook JSON
#   email:
#     to: oncall@example.com
#     from: keycloak-alerts@example.com
#     smarthost: smtp.example.com:587
#     username: keycloak-alerts@example.com

Synced from keelinfra/keycloak/examples/single-node.yml @ d02cb0f — to change it, edit it there.