SchulyKeycloak

Schuly's own Keycloak image - the production identity provider for Schuly. It bakes a Keycloakify login theme, a leaked-password blacklist (rockyou), and the schuly realm into an optimized Keycloak 26.6 build, then ships as a multi-arch container at ghcr.io/schulydev/schulykeycloak.

Quickstart (local)

docker compose -f compose.dev.yml up --build

Opens Keycloak at http://localhost:8080 (admin admin / admin) with the schuly realm imported automatically.

Quickstart (production)

docker run -p 8080:8080 \
  -e KC_DB_URL=jdbc:postgresql://db:5432/keycloak \
  -e KC_DB_USERNAME=keycloak -e KC_DB_PASSWORD=... \
  -e KC_HOSTNAME=https://auth.schuly.dev \
  -e KC_PROXY_HEADERS=xforwarded -e KC_HTTP_ENABLED=true \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=... \
  ghcr.io/schulydev/schulykeycloak:latest

For the complete stack (Postgres + reverse proxy + TLS) see Self-hosting the full stack.

Documentation

Full docs live in docs/ (and at docs.schuly.dev):

Doc	What it covers
Development setup	Run the image locally with Docker Compose.
Self-hosting	Deploy the full stack for production.
Configuration reference	Every port, environment variable, and default.
Architecture	How the theme, realm, and base image compose.
Realm management	Edit and snapshot the schuly realm (incl. 2FA).
Theme development	Work on the Keycloakify login theme.
Release	Cut a release and publish images.
Troubleshooting	Symptoms, causes, and fixes.

Contributing

Issue → branch → PR → squash-merge. See Contributing.