[{"data":1,"prerenderedAt":717},["ShallowReactive",2],{"categories-init":3,"stack-keycloak-self-hosted":4},true,{"stack_id":5,"slug":6,"name":7,"tagline":8,"long_description":9,"key_features":10,"use_cases":17,"pros":23,"cons":28,"cover_image_url":33,"scores":34,"options":47,"additions":432,"option_groups":486,"multi_select_option_types":492,"tools_by_category":493,"related_stacks":604,"faqs":671,"pricing":687,"system_requirements":702,"experience_level":657,"project_type":712,"stack_type_slug":612,"stack_type_icon_url":613,"published_date":130,"last_updated_date":33,"seo_meta":713},180,"keycloak-self-hosted","Keycloak Self-Hosted","Self-hosted Keycloak: single sign-on, OpenID Connect, and SAML for all your apps, on infrastructure you run.","**Keycloak** is the open-source identity and access management server maintained under the Cloud Native Computing Foundation. Applications hand sign-in to it over OpenID Connect, OAuth 2.0, or SAML, and receive tokens they verify with any standard library. Users sign in once and move between every app registered in the same realm.\n\nIts strength is **federation and policy**. Keycloak connects to LDAP and Active Directory, brokers sign-in through Google, GitHub, or a corporate identity provider, and enforces MFA, password policies, and fine-grained authorization from its admin console. Realms separate tenants or environments, and themes brand the login pages.\n\nIt's a **Java server with real weight**. The official sizing guide starts at about 1250 MB of memory per instance, plus roughly 300 MB outside the heap, and plans CPU by login rate. Production mode also expects a configured hostname and correct proxy headers, and gets the admin console off the public internet; most first-deployment problems are in those settings, not in Keycloak itself.\n\nThe stack suits organizations that need **enterprise single sign-on** across many applications, SAML federation with a corporate directory, or identity data that must stay on their own infrastructure, without per-user pricing at any scale.",[11,12,13,14,15,16],"Single sign-on across applications through OpenID Connect and SAML","OAuth 2.0 authorization server for APIs and third-party integrations","LDAP and Active Directory federation, plus social and enterprise identity brokering","MFA, password policies, and fine-grained authorization from the admin console","Realms for separating tenants or environments, with themed login pages","PostgreSQL storing realms, users, clients, and sessions under your control",[18,19,20,21,22],"Organizations replacing a per-user identity service across many applications","Enterprise deployments federating with Active Directory or a SAML identity provider","Regulated industries that must keep identity data on-premises","Platforms where several apps share one login","Internal tool ecosystems unified under one identity provider",[24,25,26,27],"No per-user cost at any scale","Complete OpenID Connect and SAML support, so almost any app can integrate","LDAP, Active Directory, and identity brokering built in","Identity data never leaves infrastructure you control",[29,30,31,32],"Heavier than lighter auth servers: about 1250 MB of memory per instance before PostgreSQL","Realms, clients, and authentication flows take real time to learn","Hostname, proxy, and admin-exposure settings must be right before production","High availability means clustering, which adds its own operations",null,{"popularity":35,"learning_curve":38,"flexibility":41,"performance":43,"portability":45},{"score":36,"reasoning":37},4,"Keycloak is the standard answer to self-hosted single sign-on and a long-standing fixture of enterprise Java environments; the name travels well beyond the identity specialty.",{"score":39,"reasoning":40},5,"The hardest stack in this family to master: realms, clients, flows, and federation are a discipline of their own, and Keycloak's reputation for complexity is earned.",{"score":39,"reasoning":42},"Single sign-on, OIDC, SAML, social brokering, and LDAP user federation: if an identity standard exists, Keycloak speaks it.",{"score":36,"reasoning":44},"One mid-size instance handles substantial login volume; the JVM heap and the database behind it are what to watch at scale.",{"score":36,"reasoning":46},"Every client integration rides on open protocols, and realm exports plus a plain PostgreSQL backend both travel well.",{"database":48,"orm":52,"authentication":56,"analytics":60,"coding_agent":64,"llm":68,"language":72,"frontend_framework":76,"cms":80,"hosting":84,"reverse_proxy":275,"self_hosted_paas":368},{"tools":49,"descriptions":50,"aliases":51,"see_all":33},[],{},{},{"tools":53,"descriptions":54,"aliases":55,"see_all":33},[],{},{},{"tools":57,"descriptions":58,"aliases":59,"see_all":33},[],{},{},{"tools":61,"descriptions":62,"aliases":63,"see_all":33},[],{},{},{"tools":65,"descriptions":66,"aliases":67,"see_all":33},[],{},{},{"tools":69,"descriptions":70,"aliases":71,"see_all":33},[],{},{},{"tools":73,"descriptions":74,"aliases":75,"see_all":33},[],{},{},{"tools":77,"descriptions":78,"aliases":79,"see_all":33},[],{},{},{"tools":81,"descriptions":82,"aliases":83,"see_all":33},[],{},{},{"tools":85,"descriptions":265,"aliases":271,"see_all":272},[86,131,180,202,236],{"tool_id":87,"name":88,"slug":89,"tooltip_description":90,"logo_url":91,"logo_bg":92,"pricing_model":93,"learning_curve_score":97,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":100,"subcategory":103,"categories":107,"subcategories":110,"flexibility_score":98,"performance_score":36,"portability_score":36,"is_featured":112,"tags":113,"score_reasonings":123,"published_date":129,"last_updated_date":130},52,"Hetzner","hetzner","German cloud and dedicated server provider offering VPS, bare-metal servers, and storage at prices far below the big clouds, with data centers in the EU, the US, and Singapore.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fhetzner.svg","white",{"slug":94,"display_name":95,"description":96},"paid","Paid","No meaningful free tier — a subscription or one-time purchase is required to use the tool.",2,3,"open",{"category_id":39,"name":101,"slug":102},"Hosting & Cloud","hosting-cloud",{"subcategory_id":104,"name":105,"slug":106},42,"VPS & Servers","vps-and-servers",[108],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},0,[111],{"subcategory_id":104,"name":105,"slug":106,"category_id":39,"is_primary":3,"display_order":109},false,[114,119],{"tag_id":115,"name":116,"slug":117,"tag_type":118},12,"Self-hostable","self-hostable","feature",{"tag_id":120,"name":121,"slug":122,"tag_type":118},21,"Multi-region","multi-region",{"learning_curve":124,"flexibility":125,"performance":126,"portability":127,"popularity":128},"Standard VPS setup; any developer comfortable with Linux can deploy in an afternoon.","Standard VPS; configure anything on Linux; no managed abstraction layer constraining choices.","Competitive hardware at low cost; dedicated and VPS servers deliver strong baseline performance.","Standard Linux VPS; highly portable with no managed-service abstraction to escape.","Popular among European developers and cost-conscious teams; strong reputation for value.","2026-05-29","2026-09-27",{"tool_id":132,"name":133,"slug":134,"tooltip_description":135,"logo_url":136,"logo_bg":92,"pricing_model":137,"learning_curve_score":97,"popularity_score":36,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":141,"subcategory":142,"categories":146,"subcategories":148,"flexibility_score":36,"performance_score":36,"portability_score":36,"is_featured":112,"tags":150,"score_reasonings":174,"published_date":129,"last_updated_date":130},166,"DigitalOcean","digitalocean","Developer-focused cloud platform offering VPS (Droplets), managed Kubernetes, App Platform PaaS, and managed databases. Known for simple pricing and excellent documentation.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fdigitalocean.svg",{"slug":138,"display_name":139,"description":140},"usage_based","Usage-Based","Pricing scales with consumption: API calls, data volume, compute time, or similar metered units.",{"category_id":39,"name":101,"slug":102},{"subcategory_id":143,"name":144,"slug":145},41,"App Hosting","app-hosting",[147],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[149],{"subcategory_id":143,"name":144,"slug":145,"category_id":39,"is_primary":3,"display_order":109},[151,156,160,164,165,169],{"tag_id":152,"name":153,"slug":154,"tag_type":155},40,"Web","web","platform",{"tag_id":157,"name":158,"slug":159,"tag_type":118},13,"Free Tier","free-tier",{"tag_id":161,"name":162,"slug":163,"tag_type":118},20,"Auto-scaling","auto-scaling",{"tag_id":120,"name":121,"slug":122,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},24,"Docker Compatible","docker-compatible",{"tag_id":170,"name":171,"slug":172,"tag_type":173},28,"Web Development","web-development","use_case",{"learning_curve":175,"flexibility":176,"performance":177,"popularity":178,"portability":179},"DigitalOcean is specifically designed for developers rather than enterprise ops teams. The control panel is clean, Droplets launch in under 60 seconds, and App Platform requires no infrastructure knowledge at all. Thousands of community tutorials lower the barrier for beginners.","Offers VPS, PaaS, and managed Kubernetes under one roof, covering most deployment patterns from simple static sites to complex microservices. Custom networking, firewalls, VPC peering, and a full API give teams significant control. Missing serverless functions and some niche managed services limit the ceiling slightly.","NVMe SSDs and dedicated vCPU Droplets deliver competitive single-tenant performance. The 99.99% uptime SLA holds in practice per benchmark studies. Lacks the global edge network density of Cloudflare or the ultra-low-latency primitives of AWS.","Consistently ranks in the top 5 cloud providers for developer and startup usage. Strong presence on StackOverflow, Reddit, and developer surveys. Over 600,000 active customers as of 2024. Widely used as a first production cloud by self-taught developers.","Standard Linux VMs and Docker\u002FKubernetes workloads migrate freely to any other cloud or bare metal. No proprietary runtime lock-in. Spaces is S3-compatible. App Platform lock-in is higher — migrating away requires containerizing or adapting the build pipeline.",{"tool_id":181,"name":182,"slug":183,"tooltip_description":184,"logo_url":185,"logo_bg":92,"pricing_model":186,"learning_curve_score":97,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":187,"subcategory":188,"categories":189,"subcategories":191,"flexibility_score":98,"performance_score":98,"portability_score":98,"is_featured":112,"tags":193,"score_reasonings":196,"published_date":129,"last_updated_date":130},169,"Hostinger","hostinger","Affordable web hosting with shared, cloud, and agency plans plus KVM VPS, on LiteSpeed servers with NVMe storage and the beginner-friendly hPanel control panel.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fhostinger.svg",{"slug":94,"display_name":95,"description":96},{"category_id":39,"name":101,"slug":102},{"subcategory_id":104,"name":105,"slug":106},[190],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[192],{"subcategory_id":104,"name":105,"slug":106,"category_id":39,"is_primary":3,"display_order":109},[194,195],{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"tag_id":170,"name":171,"slug":172,"tag_type":173},{"learning_curve":197,"flexibility":198,"performance":199,"popularity":200,"portability":201},"Shared hosting on Hostinger is genuinely beginner-accessible — hPanel, one-click WordPress, and the Kodee AI assistant reduce the complexity of common tasks to a few clicks. VPS plans require Linux and SSH familiarity to get full value, but the guided setup and AI assistant lower the barrier compared to raw VPS providers like Hetzner.","Shared hosting is intentionally constrained — you run within Hostinger's stack and cannot change the server environment. VPS plans give full root access and can run any Linux workload. The range from shared to VPS covers most beginner-to-intermediate deployment needs, but there is no managed Kubernetes, serverless, or edge compute option.","LiteSpeed with NVMe SSD and built-in caching delivers strong performance for shared hosting — independent benchmarks show sub-1-second load times and 99.96%+ uptime on shared plans. KVM VPS performance is competitive for the price. Not at the level of dedicated cloud providers like DigitalOcean or Hetzner for compute-intensive workloads.","Hostinger is one of the top three most-recommended budget hosts globally, with over 3 million customers and a 4.7\u002F5 Trustpilot score. It dominates beginner and bootstrapper audiences and appears consistently in 'best cheap hosting' roundups. Less visible in developer-tool and startup-stack communities compared to cloud-native platforms.","Shared hosting creates moderate lock-in via hPanel and Hostinger-specific tooling, though WordPress sites can be migrated via standard exports. VPS instances are standard KVM Linux — fully portable to any other VPS provider. No proprietary runtime or framework dependencies on the VPS side.",{"tool_id":203,"name":204,"slug":205,"tooltip_description":206,"logo_url":207,"logo_bg":208,"pricing_model":209,"learning_curve_score":36,"popularity_score":39,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":210,"subcategory":211,"categories":214,"subcategories":216,"flexibility_score":39,"performance_score":39,"portability_score":98,"is_featured":112,"tags":218,"score_reasonings":230,"published_date":129,"last_updated_date":130},50,"Amazon Web Services","aws","World's largest cloud platform with 200+ services. Market leader in infrastructure as a service (IaaS) and platform as a service (PaaS).","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Faws.png","dark",{"slug":138,"display_name":139,"description":140},{"category_id":39,"name":101,"slug":102},{"subcategory_id":152,"name":212,"slug":213},"Cloud Providers","cloud-providers",[215],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[217],{"subcategory_id":152,"name":212,"slug":213,"category_id":39,"is_primary":3,"display_order":109},[219,223,224,225,226],{"tag_id":220,"name":221,"slug":222,"tag_type":118},14,"Serverless","serverless",{"tag_id":161,"name":162,"slug":163,"tag_type":118},{"tag_id":120,"name":121,"slug":122,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":227,"name":228,"slug":229,"tag_type":173},36,"CI\u002FCD","ci-cd",{"learning_curve":231,"flexibility":232,"performance":233,"portability":234,"popularity":235},"Vast service catalog; IAM, VPC, and networking alone can take months to master.","Hundreds of composable services with full IaC support; virtually unlimited architectural freedom.","Global infrastructure; EC2, Lambda, and CloudFront deliver performance at any scale.","Broad API surface and proprietary services create meaningful lock-in; migration is possible but costly.","Market-leading cloud provider; used by the majority of production deployments globally.",{"tool_id":237,"name":238,"slug":239,"tooltip_description":240,"logo_url":241,"logo_bg":208,"pricing_model":242,"learning_curve_score":98,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":243,"subcategory":244,"categories":245,"subcategories":247,"flexibility_score":39,"performance_score":39,"portability_score":98,"is_featured":112,"tags":249,"score_reasonings":259,"published_date":129,"last_updated_date":130},51,"Google Cloud Platform","gcp","Google's cloud platform with strong data, analytics, AI, and Kubernetes capabilities. The third-largest cloud provider, after AWS and Azure.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fgcp.svg",{"slug":138,"display_name":139,"description":140},{"category_id":39,"name":101,"slug":102},{"subcategory_id":152,"name":212,"slug":213},[246],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[248],{"subcategory_id":152,"name":212,"slug":213,"category_id":39,"is_primary":3,"display_order":109},[250,251,252,253,254,255],{"tag_id":157,"name":158,"slug":159,"tag_type":118},{"tag_id":220,"name":221,"slug":222,"tag_type":118},{"tag_id":161,"name":162,"slug":163,"tag_type":118},{"tag_id":120,"name":121,"slug":122,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":256,"name":257,"slug":258,"tag_type":173},25,"Machine Learning","machine-learning",{"learning_curve":260,"flexibility":261,"performance":262,"portability":263,"popularity":264},"Slightly more approachable than AWS; BigQuery and Cloud Run have excellent documentation.","Deep service catalog; Cloud Run, GKE, and BigQuery combine freely for any architecture.","BigQuery's columnar engine handles petabyte queries in seconds; Cloud Run scales fast.","Similar to AWS; proprietary managed services create meaningful switching costs.","Strong in data and AI workloads; second or third cloud by market share in most segments.",{"hetzner":266,"digitalocean":267,"hostinger":268,"aws":269,"gcp":270},"A flat-rate root VPS from around €4-5\u002Fmo whose entry instance has 4 GB of memory, enough for Keycloak's roughly 1.5 GB plus PostgreSQL with room for login bursts. Put a firewall in front that allows only the proxy's ports, so the admin endpoints are never reachable directly.","A root Droplet with snapshots and a cloud firewall in the panel: about $12\u002Fmo for 2 GB, tight for Keycloak plus PostgreSQL, or $24\u002Fmo for a comfortable 4 GB. Managed PostgreSQL (from about $15\u002Fmo) takes the identity database off the Droplet with point-in-time recovery, the part you can least afford to lose.","The budget VPS in the list: the entry KVM plan (about $6.50\u002Fmo on a two-year term) has 4 GB of memory, enough for Keycloak and PostgreSQL. It suits a small organization's SSO; teams that need private networking between the identity server and their apps are better served by a cloud with VPCs.","An EC2 instance at roughly $25-35\u002Fmo for 4 GB, inside the VPC where your applications already run. RDS for PostgreSQL can hold the identity database with automated backups, and an Application Load Balancer with AWS Certificate Manager can terminate TLS; Keycloak then needs http-enabled and the forwarded headers set.","A Compute Engine instance at roughly $25-35\u002Fmo for 4 GB, inside the VPC where your applications run. Cloud SQL for PostgreSQL can hold the identity database, and Cloud Load Balancing with Google-managed certificates can terminate TLS; Keycloak then needs http-enabled and the forwarded headers set.",{},{"kind":273,"slug":102,"name":101,"href":274},"category","\u002Ftools\u002Fcategories\u002Fhosting-cloud",{"tools":276,"descriptions":363,"aliases":367,"see_all":33},[277,312,339],{"tool_id":278,"name":279,"slug":280,"tooltip_description":281,"logo_url":282,"logo_bg":92,"pricing_model":283,"learning_curve_score":98,"popularity_score":36,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":287,"subcategory":290,"categories":294,"subcategories":296,"flexibility_score":36,"performance_score":36,"portability_score":39,"is_featured":112,"tags":298,"score_reasonings":306,"published_date":130,"last_updated_date":33},189,"Traefik","traefik","A cloud-native reverse proxy that auto-discovers routes from Docker container labels, updating its configuration live as containers start and stop.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Ftraefik.svg",{"slug":284,"display_name":285,"description":286},"freemium","Freemium","A free tier is available; additional features, usage limits, or managed hosting require a paid plan.",{"category_id":115,"name":288,"slug":289},"DevOps & CI\u002FCD","devops-cicd",{"subcategory_id":291,"name":292,"slug":293},57,"Web Servers & Reverse Proxies","web-servers-reverse-proxies",[295],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[297],{"subcategory_id":291,"name":292,"slug":293,"category_id":115,"is_primary":3,"display_order":109},[299,303,304,305],{"tag_id":300,"name":301,"slug":302,"tag_type":118},11,"Open Source","open-source",{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":307,"flexibility":308,"performance":309,"popularity":310,"portability":311},"Basic Docker label routing is quick to pick up, but understanding the provider model, middleware chains, and dashboard takes more upfront investment than Caddy's flat config file, especially for anyone unfamiliar with label-driven tooling.","Native providers for Docker, Kubernetes, Swarm, Consul, and ECS plus a composable middleware system cover most container-routing scenarios, though its module ecosystem is narrower than NGINX's after two decades of third-party extensions.","Built in Go with an efficient routing engine, it performs comparably to Caddy for typical self-hosted and mid-scale container workloads.","It's the de facto reverse proxy for the Docker\u002FKubernetes self-hosting community and powers routing inside Coolify and Dokploy, with a large and actively growing GitHub following, though still behind NGINX's decades-long install base.","MIT licensed, ships as a single binary and official Docker image, and runs identically across any VPS, Kubernetes cluster, or cloud provider with no lock-in.",{"tool_id":313,"name":314,"slug":315,"tooltip_description":316,"logo_url":317,"logo_bg":208,"pricing_model":318,"learning_curve_score":321,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":322,"subcategory":323,"categories":324,"subcategories":326,"flexibility_score":98,"performance_score":36,"portability_score":39,"is_featured":112,"tags":328,"score_reasonings":333,"published_date":130,"last_updated_date":33},188,"Caddy","caddy","A modern web server and reverse proxy written in Go, best known for provisioning and renewing HTTPS certificates automatically with zero configuration.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fcaddy.svg",{"slug":319,"display_name":301,"description":320},"open_source","Source code is publicly available and free to use, modify, and distribute. No paid plans from the project itself.",1,{"category_id":115,"name":288,"slug":289},{"subcategory_id":291,"name":292,"slug":293},[325],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[327],{"subcategory_id":291,"name":292,"slug":293,"category_id":115,"is_primary":3,"display_order":109},[329,330,331,332],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":334,"flexibility":335,"performance":336,"popularity":337,"portability":338},"A working reverse proxy with HTTPS is typically a few lines of Caddyfile, and automatic certificate provisioning removes the TLS setup step entirely, making it one of the easiest reverse proxies to get running for the first time.","The Caddyfile and JSON config cover most reverse-proxy and static-serving needs well, but its plugin ecosystem and edge-case module coverage are considerably smaller than NGINX's after two decades of third-party modules.","Built in Go with a modern, concurrent architecture and native HTTP\u002F3 support, it performs well for typical self-hosted and small-to-mid traffic workloads, though it hasn't accumulated NGINX's extreme-scale benchmark track record.","It's a well-known, growing choice in the self-hosted community specifically for its automatic-HTTPS pitch, but its adoption and star count remain well behind NGINX's decades-long dominance.","Apache 2.0 licensed, distributed as a single static binary with an official Docker image, and runs identically on any VPS or OS with zero vendor lock-in.",{"tool_id":340,"name":341,"slug":342,"tooltip_description":343,"logo_url":344,"logo_bg":208,"pricing_model":345,"learning_curve_score":98,"popularity_score":39,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":346,"subcategory":347,"categories":348,"subcategories":350,"flexibility_score":39,"performance_score":39,"portability_score":39,"is_featured":112,"tags":352,"score_reasonings":357,"published_date":130,"last_updated_date":33},187,"NGINX","nginx","The most widely deployed web server and reverse proxy on the internet, known for event-driven performance under high concurrency.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fnginx.svg",{"slug":284,"display_name":285,"description":286},{"category_id":115,"name":288,"slug":289},{"subcategory_id":291,"name":292,"slug":293},[349],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[351],{"subcategory_id":291,"name":292,"slug":293,"category_id":115,"is_primary":3,"display_order":109},[353,354,355,356],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":358,"flexibility":359,"performance":360,"popularity":361,"portability":362},"Basic reverse-proxy blocks are simple to copy-paste, but real production setups (upstream health checks, TLS automation, rewrite rules, rate limiting) require understanding NGINX's directive-based config language in depth, and there's no built-in automatic HTTPS to lean on.","A vast module ecosystem and a fully declarative config language let it act as a reverse proxy, load balancer, cache, static file server, or WAF front-end, with third-party modules covering nearly any edge case.","Its event-driven, non-blocking architecture was purpose-built to solve the C10k problem, and it remains a top performer in every major reverse-proxy benchmark for throughput and memory efficiency under concurrent load.","It has been the most widely deployed web server on the public internet for years, appears in essentially every stack survey, and has the largest surrounding tutorial and community knowledge base of any web server.","The open-source core is free, packaged for every OS and as an official Docker image, and runs identically on any VPS or cloud provider with no vendor lock-in.",{"traefik":364,"caddy":365,"nginx":366},"Routes to the Keycloak container from Docker labels and renews Let's Encrypt certificates on its own. Set Keycloak's proxy-headers to xforwarded and http-enabled to true, and route only the \u002Frealms\u002F, \u002Fresources\u002F, and \u002F.well-known\u002F paths publicly, keeping \u002Fadmin\u002F on an internal entry point.","Automatic HTTPS from a few lines of config, the simplest fit for one Keycloak container. Caddy sends the X-Forwarded headers by default, so setting Keycloak's proxy-headers to xforwarded is enough for correct redirect URLs; add a path matcher to keep \u002Fadmin\u002F off the public site.","The proxy most enterprise ops teams already run, with TLS through Certbot. Forward the X-Forwarded headers and set Keycloak's proxy-headers to match, or requests that check their origin come back 403. Location blocks make it straightforward to expose only the public paths and keep the admin console internal.",{},{"tools":369,"descriptions":428,"aliases":431,"see_all":33},[370,402],{"tool_id":371,"name":372,"slug":373,"tooltip_description":374,"logo_url":375,"logo_bg":208,"pricing_model":376,"learning_curve_score":98,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":377,"subcategory":378,"categories":382,"subcategories":384,"flexibility_score":36,"performance_score":98,"portability_score":39,"is_featured":112,"tags":386,"score_reasonings":396,"published_date":130,"last_updated_date":33},183,"Coolify","coolify","Open-source, self-hostable PaaS that brings a Heroku\u002FVercel-style git-push deploy workflow to your own server.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fcoolify.svg",{"slug":319,"display_name":301,"description":320},{"category_id":39,"name":101,"slug":102},{"subcategory_id":379,"name":380,"slug":381},56,"Self-Hosted PaaS","self-hosted-paas",[383],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[385],{"subcategory_id":379,"name":380,"slug":381,"category_id":39,"is_primary":3,"display_order":109},[387,388,389,390,394,395],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":157,"name":158,"slug":159,"tag_type":118},{"tag_id":391,"name":392,"slug":393,"tag_type":118},23,"Git-based","git-based",{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":397,"flexibility":398,"performance":399,"popularity":400,"portability":401},"Deploying a simple app is a git-push away once Coolify is installed, but getting there requires provisioning and SSH-connecting a server first, and troubleshooting still touches Docker and Linux server concepts that a fully managed PaaS abstracts away entirely.","Supports Nixpacks, Dockerfiles, and Docker Compose directly, plus 280+ one-click services, making it capable of hosting nearly anything that runs in a container — bounded mainly by what the underlying server's resources can handle.","There is no platform-level performance ceiling of its own; a deployment's speed and headroom are a direct function of the VPS or hardware Coolify is installed on, which can range from a budget €4\u002Fmonth instance to a large dedicated server.","A fast-growing, well-starred open-source project with strong traction in the self-hosting and indie-hacker community, though it remains a niche choice relative to mainstream managed PaaS platforms like Railway, Render, or Vercel.","Apache 2.0 licensed and built entirely on standard Docker tooling with no proprietary runtime — a Coolify-managed deployment can be moved to a different server (or off Coolify entirely, back to raw Docker Compose) with minimal friction.",{"tool_id":403,"name":404,"slug":405,"tooltip_description":406,"logo_url":407,"logo_bg":208,"pricing_model":408,"learning_curve_score":97,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":409,"subcategory":410,"categories":411,"subcategories":413,"flexibility_score":36,"performance_score":98,"portability_score":39,"is_featured":112,"tags":415,"score_reasonings":422,"published_date":130,"last_updated_date":33},184,"Dokploy","dokploy","Open-source, self-hostable PaaS that deploys apps, Docker Compose stacks, and managed databases across one or more of your own servers.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fdokploy.svg",{"slug":319,"display_name":301,"description":320},{"category_id":39,"name":101,"slug":102},{"subcategory_id":379,"name":380,"slug":381},[412],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[414],{"subcategory_id":379,"name":380,"slug":381,"category_id":39,"is_primary":3,"display_order":109},[416,417,418,419,420,421],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":157,"name":158,"slug":159,"tag_type":118},{"tag_id":391,"name":392,"slug":393,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":423,"flexibility":424,"performance":425,"popularity":426,"portability":427},"A cleaner, single-page dashboard and a deployment-first workflow make basic app deployment quick to pick up once a server is connected, though the underlying Docker Swarm concepts still surface for multi-node scaling and advanced configuration.","Native Docker Compose support plus Dockerfile and buildpack deployment covers nearly any containerizable workload, and multi-database support extends it well beyond simple app hosting — bounded mainly by the underlying server's resources.","There is no platform-level performance ceiling of its own; deployment speed and headroom are a direct function of the VPS or hardware Dokploy is installed on.","A fast-growing open-source project with a large and rapidly increasing GitHub star count, though it is younger and currently has a smaller community than the category leader, Coolify.","Apache-2.0-licensed core built on standard Docker and Docker Swarm tooling with no proprietary runtime — a Dokploy-managed deployment can move to a different server, or off Dokploy entirely back to raw Docker Compose, with minimal friction.",{"coolify":429,"dokploy":430},"Free and self-hosted, deploying Keycloak's official image with PostgreSQL beside it and HTTPS through Coolify's bundled proxy. Set the hostname, proxy-headers, and http-enabled options as environment variables in the service; the template's defaults don't know your public address.","Free and self-hosted, running Keycloak and PostgreSQL behind its bundled Traefik with HTTPS from the dashboard. As with Coolify, set Keycloak's hostname and proxy settings through environment variables, and use scheduled database backups, since the database holds every user and client secret.",{},{"tunnel":433},{"tools":434,"descriptions":481,"aliases":484,"preface":485,"see_all":33},[435,460],{"tool_id":436,"name":437,"slug":438,"tooltip_description":439,"logo_url":440,"logo_bg":208,"pricing_model":441,"learning_curve_score":98,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":442,"subcategory":443,"categories":447,"subcategories":449,"flexibility_score":36,"performance_score":36,"portability_score":97,"is_featured":112,"tags":451,"score_reasonings":454,"published_date":130,"last_updated_date":33},258,"Cloudflare Tunnel","cloudflare-tunnel","Cloudflare Tunnel creates an outbound-only encrypted connection from your server to Cloudflare's network, exposing self-hosted services to the internet without opening inbound ports.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fcloudflare.svg",{"slug":284,"display_name":285,"description":286},{"category_id":115,"name":288,"slug":289},{"subcategory_id":444,"name":445,"slug":446},70,"Tunneling & Secure Access","tunneling-secure-access",[448],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[450],{"subcategory_id":444,"name":445,"slug":446,"category_id":115,"is_primary":3,"display_order":109},[452,453],{"tag_id":157,"name":158,"slug":159,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":455,"flexibility":456,"performance":457,"popularity":458,"portability":459},"Getting a tunnel running requires a Cloudflare account, a domain on Cloudflare DNS, and configuring ingress rules for each hostname — more setup than a single-binary tunnel tool, though well documented and a common homelab pattern once learned.","Ingress rules can route many hostnames to different local services from one tunnel, Zero Trust Access adds per-hostname authentication, and the same daemon handles HTTP alongside TCP\u002FUDP via WARP.","Traffic rides Cloudflare's global Anycast network end to end, giving it the same routing and edge performance as the rest of Cloudflare's CDN.","A standard recommendation in self-hosting and homelab communities for exposing services without port forwarding, though it competes with several other tunnel tools rather than being the default name people reach for first.","Tightly coupled to a Cloudflare account and DNS zone — migrating off Cloudflare means replacing the entire exposure mechanism, not just swapping a config value.",{"tool_id":461,"name":462,"slug":462,"tooltip_description":463,"logo_url":464,"logo_bg":92,"pricing_model":465,"learning_curve_score":321,"popularity_score":36,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":466,"subcategory":467,"categories":468,"subcategories":470,"flexibility_score":98,"performance_score":98,"portability_score":36,"is_featured":112,"tags":472,"score_reasonings":475,"published_date":130,"last_updated_date":33},259,"ngrok","ngrok is a globally distributed reverse proxy that creates secure public URLs for a local server in seconds, commonly used for local dev previews, webhook testing, and exposing self-hosted services.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fngrok.svg",{"slug":284,"display_name":285,"description":286},{"category_id":115,"name":288,"slug":289},{"subcategory_id":444,"name":445,"slug":446},[469],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[471],{"subcategory_id":444,"name":445,"slug":446,"category_id":115,"is_primary":3,"display_order":109},[473,474],{"tag_id":157,"name":158,"slug":159,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"learning_curve":476,"flexibility":477,"performance":478,"popularity":479,"portability":480},"A single CLI command produces a working public URL with no account configuration, DNS setup, or domain ownership required to get started.","Covers HTTP, TCP, and TLS tunnels plus Kubernetes ingress, with edge traffic policies for auth and rate limiting, though the deepest features sit behind paid plans.","Runs on a globally distributed edge network with solid latency for typical dev-preview and webhook workloads, without the scale of the largest CDN networks.","The name most developers reach for first when they need to expose a local server — long-standing mindshare in webhook testing and dev-preview workflows specifically.","A standalone client binary that works against any local service or cloud origin with no DNS zone or vendor account tie-in beyond ngrok itself, making it easy to drop into any project.",{"cloudflare-tunnel":482,"ngrok":483},"Makes Keycloak reachable over HTTPS through an outbound-only connection, with no inbound ports or static IP, for an identity server inside a private network. Publish only the public paths through the tunnel, and put Cloudflare Access in front of the admin console if it must be reachable remotely.","The quicker-start tunnel for testing an app's sign-in flow against a Keycloak on your own machine. Set Keycloak's hostname to the tunnel address while testing, since redirect URIs and token issuers are built from it; its free-tier limits suit development only.",{},"Add a tunnel when you're self-hosting without a static IP or can't open inbound ports — a home server, a VPS behind restrictive network policies, or anywhere a reverse proxy alone can't reach the internet.",{"exposure":487},{"name":488,"option_types":489},"Reverse Proxy or PaaS",[490,491],"reverse_proxy","self_hosted_paas",[],{"Databases":494,"Hosting & Cloud":529,"Authentication":542,"DevOps & CI\u002FCD":572},[495],{"tool_id":152,"name":496,"slug":497,"tooltip_description":498,"logo_url":499,"logo_bg":208,"pricing_model":500,"learning_curve_score":98,"popularity_score":39,"hosting_assignment_type":501,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":502,"subcategory":505,"categories":508,"subcategories":510,"flexibility_score":39,"performance_score":36,"portability_score":39,"is_featured":3,"tags":512,"score_reasonings":523,"published_date":129,"last_updated_date":130},"PostgreSQL","postgresql","PostgreSQL is a free, open-source object-relational database known for reliability, standards compliance, and extensibility, with rich data types, JSONB, and a large ecosystem of extensions such as PostGIS and pgvector.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fpostgresql.svg",{"slug":319,"display_name":301,"description":320},"deployable",{"category_id":36,"name":503,"slug":504},"Databases","databases",{"subcategory_id":256,"name":506,"slug":507},"OLTP Databases","oltp-databases",[509],{"category_id":36,"name":503,"slug":504,"is_primary":3,"display_order":109},[511],{"subcategory_id":256,"name":506,"slug":507,"category_id":36,"is_primary":3,"display_order":109},[513,517,518,519],{"tag_id":36,"name":514,"slug":515,"tag_type":516},"SQL","sql","technology",{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":520,"name":521,"slug":522,"tag_type":118},22,"ACID Compliant","acid-compliant",{"learning_curve":524,"flexibility":525,"performance":526,"portability":527,"popularity":528},"Standard SQL is broadly known, but CTEs, window functions, and JSONB take time to master.","Extensions like PostGIS and pgvector, custom types, and PL\u002FpgSQL cover virtually any need.","Battle-tested query planner; efficient with proper indexing and regular vacuum.","Open SQL standard with no lock-in; data and skills transfer to any SQL-compatible system.","The most popular relational database among developers per Stack Overflow 2024; rapidly growing.",[530],{"tool_id":87,"name":88,"slug":89,"tooltip_description":90,"logo_url":91,"logo_bg":92,"pricing_model":531,"learning_curve_score":97,"popularity_score":98,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":532,"subcategory":533,"categories":534,"subcategories":536,"flexibility_score":98,"performance_score":36,"portability_score":36,"is_featured":112,"tags":538,"score_reasonings":541,"published_date":129,"last_updated_date":130},{"slug":94,"display_name":95,"description":96},{"category_id":39,"name":101,"slug":102},{"subcategory_id":104,"name":105,"slug":106},[535],{"category_id":39,"name":101,"slug":102,"is_primary":3,"display_order":109},[537],{"subcategory_id":104,"name":105,"slug":106,"category_id":39,"is_primary":3,"display_order":109},[539,540],{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":120,"name":121,"slug":122,"tag_type":118},{"learning_curve":124,"flexibility":125,"performance":126,"portability":127,"popularity":128},[543],{"tool_id":544,"name":545,"slug":546,"tooltip_description":547,"logo_url":548,"logo_bg":92,"pricing_model":549,"learning_curve_score":39,"popularity_score":36,"hosting_assignment_type":550,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":551,"subcategory":33,"categories":555,"subcategories":557,"flexibility_score":39,"performance_score":98,"portability_score":39,"is_featured":112,"tags":558,"score_reasonings":566,"published_date":129,"last_updated_date":130},174,"Keycloak","keycloak","Open-source identity and access management platform with SSO, SAML 2.0, OIDC, and LDAP\u002FAD federation — self-hosted, no per-user pricing.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fkeycloak.svg",{"slug":319,"display_name":301,"description":320},"self_hostable",{"category_id":552,"name":553,"slug":554},9,"Authentication","authentication",[556],{"category_id":552,"name":553,"slug":554,"is_primary":3,"display_order":109},[],[559,560,561,562,564,565],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":152,"name":153,"slug":154,"tag_type":155},{"tag_id":563,"name":553,"slug":554,"tag_type":173},34,{"tag_id":170,"name":171,"slug":172,"tag_type":173},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"learning_curve":567,"flexibility":568,"performance":569,"popularity":570,"portability":571},"The realm\u002Fclient\u002Fflow\u002Fmapper mental model is unique to Keycloak and requires significant upfront investment — documented case studies show 40+ hours of onboarding effort even for developers with Java experience. The admin UI, while comprehensive, surfaces its full complexity immediately. Non-trivial configurations (custom flows, multi-IdP brokering, LDAP mapping) require deep familiarity with the Server Administration Guide and often trial-and-error.","Supports OAuth 2.0, OIDC, and SAML 2.0 simultaneously, making it compatible with virtually any application stack regardless of language or framework. The Service Provider Interface (SPI) system allows custom user storage providers, custom authenticators, custom event listeners, and custom themes — essentially every layer is extensible. Realm isolation supports arbitrarily complex multi-tenant topologies.","JVM-based (Quarkus) with non-trivial startup time and memory footprint relative to lightweight auth libraries. Handles high throughput at scale when properly tuned and clustered, but 'properly tuned' requires explicit effort: JVM heap sizing, Infinispan cache configuration, and database connection pooling. Out-of-the-box configuration is not optimised for production load.","34.5K GitHub stars, CNCF Incubating project status since 2023, and validated deployments in enterprise, government, and financial sectors worldwide — including the Austrian Business Service Portal (2M+ users) and FAPI-compliant authorization for Japanese banks. Well-known in enterprise Java and Spring Boot circles; less visible to indie developers and the startup ecosystem.","Apache 2.0 licensed, fully self-hosted, and deployable on any infrastructure that runs a JVM: bare-metal servers, Docker, Kubernetes (official Helm chart), or cloud VMs. Because integration is via standard OIDC and SAML protocols, client applications have no Keycloak-specific SDK dependency — migrating away requires only reconfiguring the OIDC endpoints in client applications, not replacing auth code.",[573],{"tool_id":574,"name":575,"slug":576,"tooltip_description":577,"logo_url":578,"logo_bg":208,"pricing_model":579,"learning_curve_score":36,"popularity_score":39,"hosting_assignment_type":33,"hosting_provider_restriction":99,"hosting_target_restriction":99,"hosting_compatible_tool_ids":33,"parent_tool_id":33,"category":580,"subcategory":581,"categories":585,"subcategories":587,"flexibility_score":39,"performance_score":36,"portability_score":39,"is_featured":3,"tags":589,"score_reasonings":598,"published_date":129,"last_updated_date":130},72,"Docker","docker","Container platform for packaging applications and their dependencies into portable images that run the same on a laptop, in CI, and in production, with Docker Desktop, Compose, and Docker Hub.","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fdocker.svg",{"slug":284,"display_name":285,"description":286},{"category_id":115,"name":288,"slug":289},{"subcategory_id":582,"name":583,"slug":584},33,"Containerization","containerization",[586],{"category_id":115,"name":288,"slug":289,"is_primary":3,"display_order":109},[588],{"subcategory_id":582,"name":583,"slug":584,"category_id":115,"is_primary":3,"display_order":109},[590,591,592,593,594],{"tag_id":300,"name":301,"slug":302,"tag_type":118},{"tag_id":115,"name":116,"slug":117,"tag_type":118},{"tag_id":166,"name":167,"slug":168,"tag_type":118},{"tag_id":227,"name":228,"slug":229,"tag_type":173},{"tag_id":595,"name":596,"slug":597,"tag_type":155},43,"Cross-platform","cross-platform",{"learning_curve":599,"performance":600,"portability":601,"flexibility":602,"popularity":603},"Container images, networking, volumes, and multi-stage builds all need deliberate learning.","Container overhead is minimal; near-native performance for most workloads.","Open standard; containers built with Docker run on any container-compatible platform.","Any runtime, any architecture; multi-stage builds and Compose profiles support complex systems.","The standard for containerization; present in virtually every modern software project.",[605,622,640,652],{"stack_id":606,"slug":607,"name":608,"tagline":609,"experience_level":610,"project_type":611,"stack_type_slug":612,"stack_type_icon_url":613,"score_popularity":98,"score_learning_curve":97,"catalog_display_order":33,"published_date":33,"last_updated_date":33,"core_tool_previews":614},156,"strapi-self-hosted","Strapi Self-Hosted","Self-hosted Strapi: an open-source headless CMS with PostgreSQL, on a server you control.","beginner","website","infrastructure","https:\u002F\u002Fassets.tekyous.dev\u002Ficons\u002Fstack-types\u002Finfrastructure.svg",[615,616,617],{"tool_id":152,"slug":497,"name":496,"logo_url":499,"logo_bg":208},{"tool_id":574,"slug":576,"name":575,"logo_url":578,"logo_bg":208},{"tool_id":618,"slug":619,"name":620,"logo_url":621,"logo_bg":92},88,"strapi","Strapi","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fstrapi.svg",{"stack_id":623,"slug":624,"name":625,"tagline":626,"experience_level":627,"project_type":628,"stack_type_slug":612,"stack_type_icon_url":613,"score_popularity":39,"score_learning_curve":36,"catalog_display_order":33,"published_date":33,"last_updated_date":33,"core_tool_previews":629},219,"apache-airflow-self-hosted","Airflow Self-Hosted","Self-hosted Apache Airflow: the standard data-pipeline scheduler on your infrastructure.","intermediate","data_pipeline",[630,631,635,636],{"tool_id":152,"slug":497,"name":496,"logo_url":499,"logo_bg":208},{"tool_id":143,"slug":632,"name":633,"logo_url":634,"logo_bg":208},"redis","Redis","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fredis.svg",{"tool_id":574,"slug":576,"name":575,"logo_url":578,"logo_bg":208},{"tool_id":552,"slug":637,"name":638,"logo_url":639,"logo_bg":208},"apache-airflow","Apache Airflow","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fapache-airflow.svg",{"stack_id":641,"slug":642,"name":643,"tagline":644,"experience_level":627,"project_type":645,"stack_type_slug":612,"stack_type_icon_url":613,"score_popularity":36,"score_learning_curve":98,"catalog_display_order":33,"published_date":33,"last_updated_date":33,"core_tool_previews":646},150,"n8n-self-hosted","n8n Self-Hosted","Self-hosted n8n on your own server, with full control over the database, the host, and how it's exposed to the internet.","automation",[647,648,651],{"tool_id":152,"slug":497,"name":496,"logo_url":499,"logo_bg":208},{"tool_id":520,"slug":649,"name":649,"logo_url":650,"logo_bg":208},"n8n","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fn8n.svg",{"tool_id":574,"slug":576,"name":575,"logo_url":578,"logo_bg":208},{"stack_id":653,"slug":654,"name":655,"tagline":656,"experience_level":657,"project_type":33,"stack_type_slug":612,"stack_type_icon_url":613,"score_popularity":39,"score_learning_curve":36,"catalog_display_order":33,"published_date":33,"last_updated_date":33,"core_tool_previews":658},222,"gitlab-self-hosted","GitLab Self-Hosted","Self-hosted GitLab with Docker: your code, your CI, your infrastructure.","advanced",[659,660,661,666,670],{"tool_id":152,"slug":497,"name":496,"logo_url":499,"logo_bg":208},{"tool_id":143,"slug":632,"name":633,"logo_url":634,"logo_bg":208},{"tool_id":662,"slug":663,"name":664,"logo_url":665,"logo_bg":92},152,"gitlab","GitLab","https:\u002F\u002Fassets.tekyous.dev\u002Flogos\u002Ftools\u002Fgitlab.svg",{"tool_id":667,"slug":668,"name":669,"logo_url":665,"logo_bg":92},165,"gitlab-cicd","GitLab CI\u002FCD",{"tool_id":574,"slug":576,"name":575,"logo_url":578,"logo_bg":208},[672,675,678,681,684],{"question":673,"answer":674},"Is there a managed Keycloak, or do I have to run it myself?","The Keycloak project offers no hosted service. Red Hat sells a supported build of Keycloak with a subscription, but you still run it, and a few third-party companies host Keycloak as a service. The usual managed alternative is a different product: Clerk is free up to 50,000 monthly retained users per app and Auth0 up to 25,000 monthly active users, and both bill per user beyond that. Self-hosting Keycloak removes per-user pricing entirely and keeps identity data on your servers, at the cost of running a security-critical Java service yourself.",{"question":676,"answer":677},"What does the server need to run?","Keycloak's official sizing guide puts one instance at about 1250 MB of memory for the heap and caches, plus roughly 300 MB outside the heap, so plan on about 1.5 GB for Keycloak alone. With PostgreSQL on the same server, 4 GB is the comfortable size and 2 GB is tight. CPU scales with sign-ins: the guide budgets 1 vCPU per 15 password logins a second, since password hashing dominates. A small organization's traffic fits 2 vCPUs easily.",{"question":679,"answer":680},"What needs backing up, and how do upgrades work?","PostgreSQL holds everything: realms, users, credentials, clients and their secrets, and signing keys. Back it up on a schedule and test a restore. Keycloak's export command also writes realms to JSON, which is useful for copying configuration between environments but isn't a substitute for a database backup. Keycloak migrates its schema on startup, so upgrading is a new image version; back up first and read the upgrading guide, since major versions change configuration options.",{"question":682,"answer":683},"Which Keycloak settings matter behind a reverse proxy?","Three. Set hostname to your public URL, which production mode requires, since redirect URIs and token issuers are built from it. Set proxy-headers to xforwarded or forwarded to match your proxy; without it, requests that check their origin come back 403. If the proxy terminates TLS, set http-enabled to true. Then expose only the public paths (\u002Frealms\u002F, \u002Fresources\u002F, \u002F.well-known\u002F) and keep \u002Fadmin\u002F and the master realm internal or on a separate admin hostname.",{"question":685,"answer":686},"Keycloak or BetterAuth for a self-hosted identity server?","Both run your own identity provider for several apps. Keycloak is the mature choice: SAML, LDAP and Active Directory federation, identity brokering, and a full admin console, at the cost of about 1.5 GB of memory and a real learning curve. BetterAuth, run as a dedicated server with its OAuth provider plugin, covers OpenID Connect for TypeScript teams with a much smaller footprint, but ships no admin interface. For one app that just needs logins, neither server is needed: an auth library inside the app is simpler.",{"summary":688,"starting_cost_label":689,"has_free_tier":3,"line_items":690},"Keycloak and PostgreSQL are free and open source, so the recurring cost is a server with room for Keycloak's JVM: $6-35\u002Fmo depending on the provider. There's no per-user charge at any scale, which is the comparison that matters: Clerk is free up to 50,000 monthly retained users per app and Auth0 up to 25,000 monthly active users, and both bill per user beyond that. Red Hat's supported build is the one paid option for Keycloak itself.","From ~$6\u002Fmo",[691,695,699],{"label":692,"cost":693,"note":694},"Server (VPS or cloud)","$6-35\u002Fmo","Keycloak needs about 1250 MB plus roughly 300 MB non-heap per instance; 4 GB fits it with PostgreSQL comfortably, 2 GB is tight.",{"label":696,"cost":697,"note":698},"Keycloak + PostgreSQL","Free (open source)","Apache 2.0, with unlimited realms, users, and clients and no per-user metering.",{"label":700,"cost":697,"note":701},"Exposure (reverse proxy or PaaS)","Traefik, Caddy, NGINX, Coolify, and Dokploy all self-host free, with free Let's Encrypt certificates.",{"is_official":3,"source_url":703,"items":704,"notes":711},"https:\u002F\u002Fwww.keycloak.org\u002Fhigh-availability\u002Fsingle-cluster\u002Fconcepts-memory-and-cpu-sizing",[705,708],{"label":706,"value":707},"RAM","1250 MB base per instance (heap plus realm and session caches) and roughly 300 MB non-heap",{"label":709,"value":710},"CPU","Load-based: 1 vCPU per 15 password logins per second (official sizing guide)","The official sizing guide targets HA cluster pods and load tests rather than single-server floors, so treat the base memory as one instance's working floor with the stack's PostgreSQL alongside.","api_only",{"title":714,"description":715,"og_image":33,"canonical":716},"Keycloak Self-Hosted: Tools, Pricing & How to Deploy | Tekyous","Self-hosted Keycloak: single sign-on, OpenID Connect, and SAML for all your apps, on in… Compare Keycloak Self-Hosted tools, pricing & how to deploy on Tekyous.","https:\u002F\u002Ftekyous.dev\u002Fstacks\u002Fkeycloak-self-hosted",1790518863579]