Keycloak is an open-source IAM platform for single sign-on, OAuth2, and OpenID Connect.

Includes PostgreSQL. Bootstrap admin uses SERVICE_USER_KEYCLOAK and SERVICE_PASSWORD_KEYCLOAK. Set KC_HOSTNAME via SERVICE_FQDN_KEYCLOAK when deploying behind a reverse proxy.