Keycloak LXC with real database (postgres)

[remz1337]

Hi, I recently wanted to update my manually installed keycloak LXC from v17 to v23, which was running in dev mode (as the LXC script provided by tteck). I never had issue with the dev mode database (H2) because I never had to touch it. But since the upgrade wasn't working and I couldn't find for the life of my how to inspect the H2 DB, I resorted to a full reinstall with the new version of Keycloak.

I took this opportunity to script the install process AND use a PostgreSQL DB (inside same LXC). This also allows me to run Keycloak in "production" mode

@tteck Wondering if you are interested in upgrading your Keycloak scripts to leverage a PostgreSQL DB instead of the "dev" H2 DB? If yes, I can start working on a PR

Thanks

#!/bin/bash

sudo apt update
sudo apt upgrade -y

sudo apt install openjdk-21-jdk-headless

cd /opt
sudo wget https://github.com/keycloak/keycloak/releases/download/23.0.7/keycloak-23.0.7.tar.gz

sudo tar xzf keycloak-23.0.7.tar.gz
sudo rm keycloak-23.0.7.tar.gz

mv keycloak-23.0.7 keycloak

# create a keycloak user and group
groupadd keycloak
sudo useradd -r -g keycloak -d /opt/keycloak -s /sbin/nologin keycloak

# set the directory ownership 
sudo chown -R keycloak: /opt/keycloak 
sudo chmod o+x /opt/keycloak/bin

# now we have given the keycloak user the permission to execute it's binaries 

##### INSTALL POSTGRESQL

#apt install postgresql-client-common
sudo apt install postgresql postgresql-contrib -y

sudo -i -u postgres

# Random passwords
postgresql_pwd=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1)
kc_admin_pwd=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1)

psql -c "CREATE DATABASE keycloak with encoding 'UTF8';"
psql -c "CREATE USER keycloak WITH ENCRYPTED PASSWORD '${postgresql_pwd}';"
psql -c "GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;"

#exit postgres user
exit;

keycloak_service="$(cat << EOF

[Unit]
Description=Keycloak Authorization Server
Requires=network.target
After=syslog.target network.target
 
[Service]
Type=idle
User=keycloak
Group=keycloak
ExecStart=/opt/keycloak/bin/kc.sh start
ExecStop=/opt/keycloak/bin/kc.sh stop
Restart=always
RestartSec=15
#Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
Environment="JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64"

Environment="KC_DB=postgres"
Environment="KC_DB_USERNAME=keycloak"
Environment="KC_DB_PASSWORD=${postgresql_pwd}"

Environment="KC_HOSTNAME=keycloak"

#Running behind reverse proxy that handles TLS
Environment="KC_PROXY=edge"

#Create admin account on first run
Environment="KEYCLOAK_ADMIN=admin"
Environment="KEYCLOAK_ADMIN_PASSWORD=${kc_admin_pwd}"

[Install]
WantedBy=multi-user.target

EOF
)"

echo "${keycloak_service}" > /etc/systemd/system/keycloak.service


sudo systemctl daemon-reload
sudo systemctl enable keycloak
sudo systemctl start keycloak

#Wait a couple of seconds for keycloak to setup the admin account
sleep 60

sudo systemctl stop keycloak

#Remove admin creds in service
sudo sed -i 's/Environment="KEYCLOAK_ADMIN.*/#Redacted/' /etc/systemd/system/keycloak.service

sudo systemctl daemon-reload
sudo systemctl restart keycloak