diff --git a/.vscode/cloud-configuration.code-workspace b/.vscode/cloud-configuration.code-workspace
new file mode 100644
index 0000000..69a1a8a
--- /dev/null
+++ b/.vscode/cloud-configuration.code-workspace
@@ -0,0 +1,10 @@
+{
+	"folders": [
+		{
+			"path": ".."
+		}
+	],
+	"settings": {
+		"ansible.python.interpreterPath": "/opt/homebrew/bin/python3"
+	}
+}
\ No newline at end of file
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..6a4f67a
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "ansible.python.interpreterPath": "/opt/homebrew/bin/python3"
+}
\ No newline at end of file
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
new file mode 100644
index 0000000..a3fe929
--- /dev/null
+++ b/ansible/ansible.cfg
@@ -0,0 +1,2 @@
+[defaults]
+roles_path = roles:playbooks/roles
diff --git a/ansible/inventories/host_vars/keycloak-server/private_vault.yaml b/ansible/inventories/host_vars/keycloak-server/private_vault.yaml
new file mode 100644
index 0000000..64cef01
--- /dev/null
+++ b/ansible/inventories/host_vars/keycloak-server/private_vault.yaml
@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+37626238663938613666353334626433623434656638633063373634303135323834616436333434
+3563376532353538336637326138666362393530386165310a373033373666393962393339386666
+61323339623039383531613261656139326434393433356530393231386165366235633032353831
+6662626130353736340a323963393235383461643137633739643065333536333131366634616233
+39653037636536323834313164623631653831366334303235366239333262336237396466353532
+38323461393261356337663461363732353631653164363131613032643539346665663637656365
+66353139333432363335343632373731333138343735316336336531373431623534373338363366
+66633731353331626166373265393963393936373863363538613831353636303631656564666566
+6435
diff --git a/ansible/inventories/host_vars/keycloak-server/public.yaml b/ansible/inventories/host_vars/keycloak-server/public.yaml
new file mode 100644
index 0000000..28e76fb
--- /dev/null
+++ b/ansible/inventories/host_vars/keycloak-server/public.yaml
@@ -0,0 +1,3 @@
+---
+ssh_user: keywolke
+domain: id.2martens.de
diff --git a/ansible/inventories/production b/ansible/inventories/production
index 36bd655..7e93570 100644
--- a/ansible/inventories/production
+++ b/ansible/inventories/production
@@ -14,3 +14,6 @@ repo ansible_host=shaula.uberspace.de ansible_python_interpreter=/usr/bin/python
 
 [applications]
 api-server ansible_host=49.13.77.70 ansible_python_interpreter=/usr/bin/python3
+
+[keycloak]
+keycloak-server ansible_host=monoceres.uberspace.de ansible_python_interpreter=/usr/bin/python
\ No newline at end of file
diff --git a/ansible/deploy_spring.yaml b/ansible/playbooks/deploy_spring.yaml
similarity index 100%
rename from ansible/deploy_spring.yaml
rename to ansible/playbooks/deploy_spring.yaml
diff --git a/ansible/setup.yaml b/ansible/playbooks/setup.yaml
similarity index 88%
rename from ansible/setup.yaml
rename to ansible/playbooks/setup.yaml
index e963a9e..1443cbb 100644
--- a/ansible/setup.yaml
+++ b/ansible/playbooks/setup.yaml
@@ -52,3 +52,10 @@
   tags: springBoot
   roles:
     - spring_boot
+- name: Set up Keycloak
+  hosts: keycloak
+  gather_facts: false
+  remote_user: "{{ ssh_user }}"
+  tags: keycloak
+  roles:
+    - keycloak
diff --git a/ansible/requirements.yaml b/ansible/requirements.yaml
index 8425e5a..ea9dc3e 100644
--- a/ansible/requirements.yaml
+++ b/ansible/requirements.yaml
@@ -1,4 +1,8 @@
 ---
 collections:
-- community.docker
-- community.general
+  - community.docker
+  - community.general
+  - community.mysql
+  - ansible.posix
+  - hetzner.hcloud
+  - middleware_automation.keycloak
diff --git a/ansible/roles/drone/tasks/docker.yaml b/ansible/roles/drone/tasks/docker.yaml
index 1a9176a..ea63a73 100644
--- a/ansible/roles/drone/tasks/docker.yaml
+++ b/ansible/roles/drone/tasks/docker.yaml
@@ -19,5 +19,5 @@
     group: root
     mode: "644"
 - name: Start drone docker container
-  community.docker.docker_compose:
+  community.docker.docker_compose_v2:
     project_src: /etc/drone
diff --git a/ansible/roles/kafka/tasks/main.yaml b/ansible/roles/kafka/tasks/main.yaml
index 018a9bf..74f3f73 100644
--- a/ansible/roles/kafka/tasks/main.yaml
+++ b/ansible/roles/kafka/tasks/main.yaml
@@ -20,5 +20,5 @@
     state: present
     appends: true
 - name: Start kafka docker container
-  community.docker.docker_compose:
+  community.docker.docker_compose_v2:
     project_src: /opt/kafka
diff --git a/ansible/roles/keycloak/defaults/main.yaml b/ansible/roles/keycloak/defaults/main.yaml
new file mode 100644
index 0000000..198eb0c
--- /dev/null
+++ b/ansible/roles/keycloak/defaults/main.yaml
@@ -0,0 +1,7 @@
+---
+keycloak_version: 26.1.0
+
+# Database Configuration Defaults
+keycloak_db_host: localhost
+keycloak_db_port: 3306
+keycloak_db_type: mariadb
diff --git a/ansible/roles/keycloak/tasks/debug.yaml b/ansible/roles/keycloak/tasks/debug.yaml
new file mode 100644
index 0000000..761cb9f
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/debug.yaml
@@ -0,0 +1,6 @@
+---
+- name: Print next steps
+  ansible.builtin.debug:
+    msg: "Login with the temp admin ({{ keycloak_temp_admin_user }}:{{ keycloak_temp_admin_password }}) and
+          create a proper admin user: https://{{ domain }}/admin/master/console"
+  when: bootstrap.changed
diff --git a/ansible/roles/keycloak/tasks/download.yaml b/ansible/roles/keycloak/tasks/download.yaml
new file mode 100644
index 0000000..48b82e5
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/download.yaml
@@ -0,0 +1,20 @@
+---
+- name: Check if Keycloak is already downloaded
+  ansible.builtin.stat:
+    path: ~/keycloak-{{ keycloak_version }}
+  register: keycloak_dir
+
+- name: Download Keycloak
+  ansible.builtin.unarchive:
+    src: https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/keycloak-{{ keycloak_version }}.tar.gz
+    dest: ~
+    remote_src: true
+    creates: ~/keycloak-{{ keycloak_version }}
+  when: not keycloak_dir.stat.exists
+
+- name: Create symlink to current Keycloak version
+  ansible.builtin.file:
+    src: ~/keycloak-{{ keycloak_version }}
+    dest: ~/keycloak-current
+    state: link
+  when: not keycloak_dir.stat.exists
diff --git a/ansible/roles/keycloak/tasks/main.yaml b/ansible/roles/keycloak/tasks/main.yaml
new file mode 100644
index 0000000..085a9a2
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/main.yaml
@@ -0,0 +1,11 @@
+---
+- name: Set up database
+  ansible.builtin.import_tasks: mysql.yaml
+- name: Download archive
+  ansible.builtin.import_tasks: download.yaml
+- name: Set up Keycloak
+  ansible.builtin.import_tasks: setup.yaml
+- name: Set up service
+  ansible.builtin.import_tasks: service.yaml
+- name: Print next steps
+  ansible.builtin.import_tasks: debug.yaml
diff --git a/ansible/roles/keycloak/tasks/mysql.yaml b/ansible/roles/keycloak/tasks/mysql.yaml
new file mode 100644
index 0000000..532839d
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/mysql.yaml
@@ -0,0 +1,6 @@
+---
+- name: Create MySQL database
+  community.mysql.mysql_db:
+    name: "{{ ssh_user }}_keycloak"
+    state: present
+  register: database
diff --git a/ansible/roles/keycloak/tasks/service.yaml b/ansible/roles/keycloak/tasks/service.yaml
new file mode 100644
index 0000000..a15a65c
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/service.yaml
@@ -0,0 +1,19 @@
+---
+- name: Create service directory
+  ansible.builtin.file:
+    state: directory
+    path: /home/{{ ssh_user }}/etc/services.d
+    owner: "{{ ssh_user }}"
+    group: "{{ ssh_user }}"
+    mode: "755"
+- name: Create Keycloak service
+  ansible.builtin.template:
+    src: etc/services.d/keycloak.ini.j2
+    dest: /home/{{ ssh_user }}/etc/services.d/keycloak.ini
+    owner: "{{ ssh_user }}"
+    group: "{{ ssh_user }}"
+    mode: "644"
+- name: Start Keycloak
+  community.general.supervisorctl:
+    state: started
+    name: keycloak
diff --git a/ansible/roles/keycloak/tasks/setup.yaml b/ansible/roles/keycloak/tasks/setup.yaml
new file mode 100644
index 0000000..06d3f7a
--- /dev/null
+++ b/ansible/roles/keycloak/tasks/setup.yaml
@@ -0,0 +1,88 @@
+---
+- name: Check if service exists
+  ansible.builtin.stat:
+    path: /home/{{ ssh_user }}/etc/services.d/keycloak.ini.j2
+  register: service
+- name: Shutdown Keycloak
+  community.general.supervisorctl:
+    name: keycloak
+    state: stopped
+  when: service.stat.exists
+- name: Update configuration
+  block:
+    - name: Set db type
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db='
+        line: "db={{ keycloak_db_type }}"
+    - name: Set db username
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db-username='
+        line: "db-username={{ ssh_user }}"
+    - name: Set db password
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db-password='
+        line: "db-password={{ keycloak_db_password }}"
+    - name: Set db host
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db-url-host='
+        line: "db-url-host={{ keycloak_db_host }}"
+    - name: Set db port
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db-url-port='
+        line: "db-url-port={{ keycloak_db_port }}"
+    - name: Set db name
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?db-url-database='
+        line: "db-url-database={{ ssh_user }}_keycloak"
+    - name: Enable http
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?http-enabled='
+        line: "http-enabled=true"
+    - name: Set ssl certificate
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?https-certificate-file='
+        line: "https-certificate-file=/home/{{ ssh_user }}/etc/certificates/{{ domain }}.crt"
+    - name: Set ssl certificate key
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?https-certificate-key-file='
+        line: "https-certificate-key-file=/home/{{ ssh_user }}/etc/certificates/{{ domain }}.key"
+    - name: Set proxy mode to edge
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?proxy='
+        line: "proxy=edge"
+    - name: Set proxy headers to xforwarded
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?proxy-headers='
+        line: "proxy-headers=xforwarded"
+    - name: Set hostname
+      ansible.builtin.lineinfile:
+        path: ~/keycloak-current/conf/keycloak.conf
+        regex: '#?hostname='
+        line: "hostname={{ domain }}"
+- name: Build application
+  ansible.builtin.command:
+    chdir: ~/keycloak-current/bin
+    cmd: ./kc.sh build
+  register: build
+  changed_when: true
+- name: Create temp admin
+  ansible.builtin.command:
+    chdir: ~/keycloak-current/bin
+    cmd: ./kc.sh bootstrap-admin user --username:env KEYCLOAK_ADMIN_USER --password:env KEYCLOAK_ADMIN_USER_PASSWORD --optimized
+  environment:
+    KEYCLOAK_ADMIN_USER: keycloakbootstrap
+    KEYCLOAK_ADMIN_USER_PASSWORD: "{{ keycloak_temp_admin_password }}"
+  when: database.changed
+  register: bootstrap
+  changed_when: true
diff --git a/ansible/roles/keycloak/templates/etc/services.d/keycloak.ini.j2 b/ansible/roles/keycloak/templates/etc/services.d/keycloak.ini.j2
new file mode 100644
index 0000000..eadfb92
--- /dev/null
+++ b/ansible/roles/keycloak/templates/etc/services.d/keycloak.ini.j2
@@ -0,0 +1,8 @@
+[program:keycloak]
+command=%(ENV_HOME)s/keycloak-current/bin/kc.sh start --optimized
+autostart=yes
+autorestart=yes
+
+[program:keycloak]
+# `startsecs` is set by Uberspace monitoring team, to prevent a broken service from looping
+startsecs=30
diff --git a/ansible/roles/server_setup/defaults/main.yaml b/ansible/roles/server_setup/defaults/main.yaml
index ff9f62d..9585a5f 100644
--- a/ansible/roles/server_setup/defaults/main.yaml
+++ b/ansible/roles/server_setup/defaults/main.yaml
@@ -1,6 +1,6 @@
 ---
-basic_firewall: basic-firewall
-server_image: ubuntu-22.04
-server_location: fsn1
-server_placement_group: default
-server_type: cax11
+server_setup_basic_firewall: basic-firewall
+server_setup_server_image: ubuntu-22.04
+server_setup_server_location: fsn1
+server_setup_server_placement_group: default
+server_setup_server_type: cax11
diff --git a/ansible/roles/server_setup/tasks/create-server.yaml b/ansible/roles/server_setup/tasks/create-server.yaml
index f1e50e3..efa9c91 100644
--- a/ansible/roles/server_setup/tasks/create-server.yaml
+++ b/ansible/roles/server_setup/tasks/create-server.yaml
@@ -1,22 +1,22 @@
 ---
 - name: Create SSH key
-  hetzner.hcloud.hcloud_ssh_key:
-    api_token: "{{ hcloud_api_token }}"
-    public_key: "{{ ssh_key_admin_user }}"
-    name: "{{ ssh_key_admin_user_name }}"
+  hetzner.hcloud.ssh_key:
+    api_token: "{{ server_setup_hcloud_api_token }}"
+    public_key: "{{ server_setup_ssh_key_admin_user }}"
+    name: "{{ server_setup_ssh_key_admin_user_name }}"
     state: present
 - name: Create server via HCloud
-  hetzner.hcloud.hcloud_server:
-    api_token: "{{ hcloud_api_token }}"
+  hetzner.hcloud.server:
+    api_token: "{{ server_setup_hcloud_api_token }}"
     firewalls:
-      - "{{ basic_firewall }}"
-    image: "{{ server_image }}"
-    location: "{{ server_location }}"
-    name: "{{ server_name }}"
-    placement_group: "{{ server_placement_group }}"
-    server_type: "{{ server_type }}"
+      - "{{ server_setup_basic_firewall }}"
+    image: "{{ server_setup_server_image }}"
+    location: "{{ server_setup_server_location }}"
+    name: "{{ server_setup_server_name }}"
+    placement_group: "{{ server_setup_server_placement_group }}"
+    server_type: "{{ server_setup_server_type }}"
     ssh_keys:
-      - "{{ ssh_key_admin_user_name }}"
+      - "{{ server_setup_ssh_key_admin_user_name }}"
     user_data: "{{ lookup('ansible.builtin.template', 'basic-ssh-hardening.yaml.j2', convert_data=false) }}"
     state: present
   register: server
diff --git a/ansible/roles/spring_boot/tasks/docker.yaml b/ansible/roles/spring_boot/tasks/docker.yaml
index edfc4c8..54d255a 100644
--- a/ansible/roles/spring_boot/tasks/docker.yaml
+++ b/ansible/roles/spring_boot/tasks/docker.yaml
@@ -15,5 +15,5 @@
     mode: "644"
     lstrip_blocks: true
 - name: Start application docker container
-  community.docker.docker_compose:
+  community.docker.docker_compose_v2:
     project_src: /opt/{{ spring_docker_path }}
diff --git a/ansible/site.yaml b/ansible/site.yaml
deleted file mode 100644
index 0c2734b..0000000
--- a/ansible/site.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-- include: setup.yaml
diff --git a/argocd/prometheus/monitoring/.DS_Store b/argocd/prometheus/monitoring/.DS_Store
new file mode 100644
index 0000000..6b2b924
Binary files /dev/null and b/argocd/prometheus/monitoring/.DS_Store differ
diff --git a/helm/cluster_setup/values.yaml b/helm/cluster_setup/values.yaml
index 0363025..c0693ca 100644
--- a/helm/cluster_setup/values.yaml
+++ b/helm/cluster_setup/values.yaml
@@ -6,13 +6,13 @@ vault:
   # creates each of the namespaces
   applicationNamespaces: []
 ecr:
-  enabled: false
-  account: ""
   accessKey:
     id: ""
     secret: ""
-  repository: ""
+  account: ""
   applicationNamespaces: []
+  enabled: false
+  repository: ""
 hcloud:
   enabled: false
   token: ""