diff --git a/deploy_matrix.yml b/deploy_matrix.yml
index 5a1aa8e..3963347 100644
--- a/deploy_matrix.yml
+++ b/deploy_matrix.yml
@@ -39,10 +39,11 @@
         - "{{ vol_db }}"  
         - "{{ npm_data }}"
         - "{{ npm_letsencrypt }}"
-        - "{{ lemonldap_data }}"
+        - "{{ keycloak_data }}"
+        - "{{ vol_kc_db }}"
 
     # -----------------------------------------------------------------
-    # Pull required images (including Teamspeak)
+    # Pull required images 
     # -----------------------------------------------------------------
 
     - name: Pull coturn image
@@ -244,4 +245,39 @@
         network: "{{ podman_network }}"
         restart_policy: always
 
-    
\ No newline at end of file
+    # -----------------------------------------------------------------
+    # Start Keyclaok and supporting DB containers
+    # -----------------------------------------------------------------
+
+    - name: start Keyclaok Database container
+      containers.podman.podman_container:
+        name: keycloak-db
+        image: "{{ db_image }}"
+        state: started
+        env:
+          POSTGRES_USER: "{{ keycloak_postgres_user }}"
+          POSTGRES_PASSWORD: "{{ keycloak_postgres_pw }}"
+          POSTGRES_DB: "{{ keycloak_db }}"
+        volumes:
+          - "{{ vol_kc_db }}:/var/lib/postgresql/data"        
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    - name:  Start Keycloak authentication container
+      containers.podman.podman_container:
+        name: "{{ keycloak_container_name }}"
+        image: "{{ keycloak_image }}"
+        command: ["start"]
+        env:
+          KC_DB: postgres
+          KC_DB_URL: jdbc:keycloak-db://postgres/keycloak
+          KC_DB_USERNAME: "{{ keycloak_postgres_user }}"
+          KC_DB_PASSWORD: "{{ keycloak_postgres_pw }}"
+          KC_HOSTNAME: "{{ keycloak_domain }}"
+          KC_HOSTNAME_PORT: "{{ kc_hn_port }}"
+          KEYCLOAK_ADMIN: "{{ keycloak_admin }}"
+          KEYCLOAK_ADMIN_PASSWORD: "{{ keycloak_pw }}"
+        volumes:
+          - "{{ keycloak_data }}:/opt/keycloak/data:Z"
+        network: "{{ podman_network }}"
+        restart_policy: always
diff --git a/vars/vars.yml b/vars/vars.yml
index 0f16483..3327014 100644
--- a/vars/vars.yml
+++ b/vars/vars.yml
@@ -10,6 +10,7 @@ turn_domain: "turn.fpov.space"
 matrix_email: "boxswappers@gmail.com"
 admin_domain: "mtxadm.fpov.space"
 element_domain: "element.fpov.space"
+keycloak_domain: "auth.fpov.space"
 
 # --------------------------------------------------------------
 # Ports
@@ -44,6 +45,10 @@ postgres_db: synapse
 postgres_user: mMwHLfdO6tz5N
 postgres_pw: 9mKeSFE7tH2eY
 
+keycloak_db: keycloak
+keycloak_postgres_user: wCdfpLp3j208
+keycloak_postgres_pw: F7C3arx1ZGHh
+
 # --------------------------------------------------------------
 # Container images
 # --------------------------------------------------------------
@@ -71,6 +76,8 @@ vol_teamspeak: teamspeak_data
 npm_data: npm_data
 npm_letsencrypt: letsencrypt  
 vol_db: postgres_db   
+vol_kc_db: kc_postgres
+keycloak_data: kc_data
 
 # --------------------------------------------------------------
 # Paths on the target host (temporary files)
@@ -117,3 +124,10 @@ landing_message: |
   automatic Let’s Encrypt certificates, a TURN server for voice/video, and a
   simple landing page.
 
+# --------------------------------------------------------------
+# Keycloak Auth
+# --------------------------------------------------------------
+kc_hn_port: "8080"
+keycloak_admin: "mQ4vN06xWgIQ"
+keycloak_pw: "I71bUBkhPY6E"
+keycloak_container_name: "keycloak"
\ No newline at end of file