diff --git a/modules/keycloak.nix b/modules/keycloak.nix
new file mode 100644
index 0000000..d196ac9
--- /dev/null
+++ b/modules/keycloak.nix
@@ -0,0 +1,25 @@
+{ config, ... }: {
+  services.keycloak = {
+    enable = true;
+    settings = {
+      http-host = "127.0.0.1";
+      http-port = 9083;
+      https-port = 9084;
+      http-enabled = true;
+
+      proxy = "edge";
+
+      # https-port = 9084;
+      hostname = "login.clicks.codes";
+      hostname-strict = false;
+
+      https-certificate-file = "/var/keycloak/login.clicks.codes.rsa.cert.pem";
+      https-certificate-key-file = "/var/keycloak/login.clicks.codes.rsa.private.pem";
+    };
+    database = {
+      createLocally = false;
+      port = config.services.postgresql.port;
+      passwordFile = config.sops.secrets.clicks_keycloak_db_password.path;
+    };
+  };
+}