# Keycloak — First-Time Setup

## Prerequisites

- DNS: `keycloak.<domain_suffix>` must resolve to the server

## Steps

1. **Create the app:**
   ```bash
   abra app new keycloak --server <SERVER> --domain keycloak.<DOMAIN_SUFFIX> --no-input
   ```

2. **Generate secrets:**
   ```bash
   abra app secret generate keycloak.<DOMAIN_SUFFIX> --all -m --no-input
   ```
   Save output to `recipe-info/testsecrets/keycloak.<DOMAIN_SUFFIX>`.

3. **Deploy:**
   ```bash
   abra app deploy keycloak.<DOMAIN_SUFFIX> --chaos --force --no-input
   ```

4. **Verify:** curl `https://keycloak.<DOMAIN_SUFFIX>/realms/master` returns HTTP 200.

## Notes

- Keycloak health check uses `/realms/master` (root `/` returns 302).
- Admin credentials: username `admin`, password from `admin_password` secret.