---
title: "Deploy Keycloak"
description: "Self-hosted Keycloak 26.x with PostgreSQL — deploy in minutes"
category: "Authentication"
url: https://railway.com/deploy/keycloak-1
---

# Deploy Keycloak

Self-hosted Keycloak 26.x with PostgreSQL — deploy in minutes

**[Deploy Keycloak on Railway](https://railway.com/template/keycloak-1)**

- **Creator:** INAPP
- **Category:** Authentication
- **Total deploys:** 2

## Template content

### postgres

- **Image:** postgres:16-alpine

### keycloak

- **Source:** https://github.com/INAPP-Mobile/keycloak
- **Public domain:** Yes

## Documentation

# Deploy and Host keycloak on Railway
 
Keycloak is an open-source identity and access management solution for modern apps and services. It supports OAuth 2.0, OpenID Connect, SAML 2.0, social login, user federation, and a centralized admin UI for users, roles, and clients.
 
## About Hosting keycloak
 
Deploying Keycloak on Railway provisions a Keycloak 26.x instance alongside a sibling PostgreSQL database in a single project. Keycloak connects to postgres over Railway's private network (postgres.railway.internal). The template sets the official Keycloak 26.x env vars (KC_HOSTNAME, KC_BOOTSTRAP_ADMIN_PASSWORD, KC_DB_URL/USERNAME/PASSWORD, KC_PROXY=edge, KC_HTTP_ENABLED, KC_PROXY_HEADERS), generates a secure admin password on first deploy, and uses TLS termination at the Railway edge. Persistent storage uses a Railway volume mounted at the parent path /var/lib/postgresql, which keeps the ext4 lost+found/ directory outside the PGDATA subpath and avoids the common first-deploy initdb crash.
 
## Common Use Cases
 
- Single sign-on (SSO) for a SaaS stack with OAuth 2.0 / OIDC
- Centralized user management and identity federation for an internal platform
- Authentication provider for microservices behind an API gateway
 
## Dependencies for keycloak Hosting
 
- PostgreSQL 16 (sibling service included in the template)
- A public hostname (Railway provides a default *.up.railway.app subdomain automatically)
 
### Deployment Dependencies
 
- Keycloak documentation: https://www.keycloak.org/documentation
- Keycloak 26.x server configuration: https://www.keycloak.org/server/configuration
 
### Implementation Details
 
This template uses a **parent-mount volume geometry** for the PostgreSQL service: the Railway volume is mounted at `/var/lib/postgresql` (parent, not `/var/lib/postgresql/data`), and `PGDATA=/var/lib/postgresql/data`. The ext4 lost+found/ lives at the volume root — outside PGDATA — so initdb runs cleanly.
 
Keycloak 26.x is started with `kc.sh start` (no `--optimized`); the Quarkus dev build warms the prebuilt-server cache on first boot and subsequent restarts use it automatically. The container listens on port 8080 as UID 1000 and is fronted by Railway's edge proxy with `KC_PROXY=edge`.
 
## Why Deploy keycloak on Railway?
 

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.
 
By deploying keycloak on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/keycloak-1