Keycloak - intentional that service deploys in development mode on install?

[max-brod]

Hello,

Disclaimer: This is a home lab deployment but for the sake of learning I wish to secure all my applications as if running in a business production setting. I am not very familiar with LXC containers yet.

I am pretty new to using Keycloak and deploying community-scripts such as these. I have read that it is not ideal to run Keycloak under development mode in a production environment for several security-related reasons.
How come that the script that installs Keycloak on an LXC does not account for this and deploys the service to run the executable in development mode? Is this intentional?

What is the intended way within the realm of this script to "upgrade" to production later on? Is there a way to switch to production within the Keycloak admin panel itself that I may have missed at some point? If not, should I edit the service itself to not use "start-dev" once everything is ready to run in production?

I do not intend to expose Keycloak directly as I will be putting it behind a reverse proxy.

Do you people have any advice for me? Am I overlooking something obvious?

Thank you for your time!

[jd-apprentice]

Hihi! At least for my understanding these scripts won't include what are "Production ready" installations, but I'll suggest you read something like:

https://www.keycloak.org/server/configuration-production

Which includes common practices to expose a Keycloak instance to the world, and yeah you may change some things here and there. You could also have it LAN only (depending on how things are communicating in your servers, or if you are willing to develop something in the meantime your instance is ready to be exposed).

Also here is a cool topic about it:

https://medium.com/@atondelier/keycloak-for-production-level-saas-authentication-b2ef0b1138d4

In any case I'll suggest you ask in some or their social media https://www.keycloak.org/community

[tremor021]

This is not true. We install the apps following the official install instructions (if present), or by translating Dockerfile/Makefile into a bare metal installs (for apps that are docker only). In case of a application that has a paid/license based model, we deploy the free to use version of said app. We don't deploy local dev versions unless thats the only possible deployment or the app is designed to run that way.
Almost all apps out there have instructions on how to deploy to production environment. We are following those instructions.

That said, we are not recommending ANY of our scripts to be used in official production environment, because apps constantly change, breaking changes are introduced all the time. We are supporting you to use it in your own homelab, but other than that we are not encouraging you to use these scripts commercially or in any type of production environment.

[jd-apprentice]

Thanks for the clarification! I was not sure about that, my bad.

[max-brod]

@tremor021

[...] We don't deploy local dev versions unless thats the only possible deployment or the app is designed to run that way. Almost all apps out there have instructions on how to deploy to production environment. We are following those instructions.
[...]

This is confusing to me, as the Keycloak deployment very much so DOES deploy as a local dev version, as evidenced within the command that invokes the Keycloak binary being start-dev instead of start. Keycloak has a separate instruction page on production deployment and that page and the initial setup page directly advises AGAINST running Keycloak with start-dev under production.
Would you like to provide additional clarification on that please? To me this seems contradictory

[tremor021]

Perhaps at the time of writing the script that was the only viable method of installing. Things constantly change, we can't really keep track of these things, so we rely on users to report such issues.

I can only say that we will look into the official documentation and see if we need to update the script