diff --git a/docker-compose.yml b/docker-compose.yml
index 148b0c3..65dccaf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,6 +14,7 @@
       - "80:80"
       - "443:443"
     networks:
+      - kcnet
       - simpleidnet
       - gerritnet
     volumes:
@@ -34,6 +35,30 @@
       - ./postgres/init.sh:/docker-entrypoint-initdb.d/init.sh:ro
       - ./postgres/data/:/var/lib/postgresql/data/:rw
       - ./postgres/passwd/:/tmp/passwd/:rw
+  keycloak:
+    build:
+      context: ./keycloak/docker/
+      args:
+        - KC_DB=postgres
+    networks:
+      - kcnet
+      - dbnet
+    env_file: environment
+    environment:
+      - KC_PROXY=edge
+      - KC_HOSTNAME_DEBUG=true
+      - KC_HOSTNAME_STRICT=true
+      - KC_HOSTNAME_STRICT_BACKCHANNEL=true
+      - KC_HOSTNAME_URL=https://id.${SA_PUBLIC_DOMAIN_NAME}/
+      - KC_HOSTNAME_ADMIN_URL=https://id.${SA_PUBLIC_DOMAIN_NAME}/
+      - KC_DB_USERNAME=keycloak
+      - KC_DB_URL_HOST=postgres
+      - KC_DB_URL=jdbc:postgresql://postgres/keycloak
+      - KC_DB_POOL_MAX_SIZE=16
+      - KEYCLOAK_ADMIN=deusarcadia
+      - KEYCLOAK_ADMIN_PASSWORD=arcanumhomini
+    volumes:
+      - ./postgres/passwd/keycloak/:/tmp/passwd/db/:ro
   simpleid:
     build:
       context: .
@@ -88,6 +113,7 @@
       - "993:993"  # IMAP4 (implicit TLS)
     networks:
       - gerritnet
+      - kcnet
     volumes:
       - ./logs/mail-supervisor/:/var/log/supervisor/:rw
       - ./logs/mail/:/var/log/mail/:rw
@@ -123,3 +149,8 @@
     ipam:
       config:
         - subnet: 10.12.14.40/29
+  kcnet:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.12.14.48/29