Keycloak, Sealed on Your Own Server
SSO for every app you run, with no per-user bill.
Your identity provider holds the keys to everything.
So the host boots only what your org signed.
us.kheeper.com/public/keycloak
- Keycloak, with OIDC, SAML, LDAP and AD federation, MFA and passkeys
- Caddy, with automatic TLS on your domain
- Postgres on the same box, backed up continuously
- Grafana and a metrics stack, with logins and failures by realm
- A signed boot chain: change a byte and it won't read
Okta and Auth0 bill your headcount.
A server does not.
Per user, forever
Every sign-in to every app runs through someone else's service. The bill tracks headcount, and SSO, MFA and provisioning are often add-ons on top.
Free, plus a team
Keycloak is free, but running it means a JVM, Postgres, backups, certificates and upgrades — on a box that, if tampered with, signs anyone in as anyone.
One sealed box, flat
One image with all of it inside, released sealed so the host verifies every file it reads. Kheeper charges for storage, bandwidth and hosts — never for people.
Questions
Is Keycloak a replacement for Okta?
For single sign-on, yes. Keycloak speaks OIDC and SAML to your apps, federates users from LDAP or Active Directory, and handles MFA, passkeys and social login. It is a CNCF project under the Apache 2.0 licence.
What does sealed mean?
The host boots a kernel signed with your org's Secure Boot key, and that kernel pins a digest of the whole filesystem. Every file is checked as it is read, so a modified binary or config will not load.
Where can it run?
Sealed images need a host installed with bootc's composefs backend. Today that is bare metal installed over iPXE.
How is the database backed up?
Postgres archives every WAL segment and takes a daily base backup to Kheeper's object store, keeping the last seven. No storage credentials live on the host.