DCA Hardened Identity Provider — for Keycloak™ — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	Keycloak (Apache-2.0) — see licenses
Version	Keycloak 26.8.0 (upstream server distribution, sha256- and signature-verified) on Ubuntu's OpenJDK 21, Ubuntu 24.04 LTS; Google Cloud image built 2026-10-07. Exact image version: see the listing. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• Google Cloud Marketplace — listing in preparation — Compute Engine image and deployment package built and verified on booted VMs; not yet public (base: Ubuntu 24.04 LTS)

Network ports

Port	Purpose	State
22	SSH — key-only, OS Login (IAM); the deployment package adds no SSH rule	your VPC's firewall rules
8080	Keycloak HTTP (admin console, realms, API) — bound to 127.0.0.1; reach it through an IAP SSH tunnel	loopback only
9000	Management interface (/health/ready) — inherits http-host, so 127.0.0.1	loopback only
8443	HTTPS — not listening until you configure a certificate	customer-must-open (config + firewall toggle)

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH in with OS Login and forward port 8080 (gcloud compute ssh INSTANCE_NAME --zone ZONE --tunnel-through-iap -- -L 8080:127.0.0.1:8080), then open http://localhost:8080/admin/.

A bootstrap administrator, admin, with a 32-character password generated on THIS VM's first boot by keycloak-firstboot.service; Keycloak creates the master realm, its signing keys and that administrator on its first start. Your copy: /root/keycloak-admin-credentials.txt (root-only, 0600). No administrator, realm or key exists in the image.

sudo cat /root/keycloak-admin-credentials.txt

Rotation: Keycloak treats this account as a temporary admin: sign in, create a permanent administrator in the master realm, then delete admin or give it a new password (Configuration page).

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /opt/keycloak/data (embedded H2 file database under data/h2) — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: keycloak-firstboot.service mints the bootstrap administrator before keycloak.service first starts; Keycloak creates the master realm with it; keycloak-verify-firstboot.service proves the administrator obtains a token, a wrong password is refused, the version is 26.8.0 and every listener is loopback-only, then removes /etc/keycloak/bootstrap-admin.env and writes /var/lib/dca-firstboot/keycloak.verified. The first start takes a while; health/ready answers UP when it is done.
• Update / patch: Recommended: export your realms, deploy the newest image version and import them. Keycloak is not an apt package here, so apt and unattended-upgrades never change it (they patch Ubuntu and OpenJDK 21); an in-place upgrade means installing a newer verified distribution alongside /opt/keycloak and moving conf/ and data/ across.
• Backup / restore: Stop keycloak and copy /opt/keycloak/data (the H2 database), or snapshot the boot disk; kc.sh export (service stopped) writes a portable JSON copy of realms and users.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: systemd journal: journalctl -u keycloak -f
• Health check: curl -fsS http://127.0.0.1:9000/health/ready → status UP

Known limitations

Single node with Keycloak's embedded H2 file database (db=dev-file) and a local cache; Keycloak's guidance for production is an external database. No HTTPS listener until you add a certificate.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy

Keycloak™ names the open-source software this image packages. Derek Coleman & Associates Inc is not affiliated with or endorsed by the Keycloak project.