From bae4a3cf76bf2ee701665052d227d3fb732bf2e1 Mon Sep 17 00:00:00 2001
From: misha <mail@mishavelthuis.nl>
Date: Tue, 13 Oct 2026 00:53:39 +0200
Subject: [PATCH] Added keycloak integration

---
 README.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/README.md b/README.md
index ed2af52..757722f 100644
--- a/README.md
+++ b/README.md
@@ -79,3 +79,32 @@ app app secret insert git.example.coop signing_public_key v1 -f ~/.ssh/id_ed2551
 app app secret insert git.example.coop signing_private_key v1 -f ~/.ssh/id_ed25519
 app app deploy git.example.coop
 ```
+
+## Set-up Keycloak authentication
+
+This example uses https://git.coop.tech and https://keycloak.coop.tech as an example. Replace them with your own domains:
+
+### Settings in keycloak
+
+- If you haven't already done so for other services, create a realm.
+- Within that realm, create a client.
+  - Client type = OpenID Connect
+  - Client ID = forgejo 
+  - Client authentication -> on
+  - Authorization -> on
+  - Standard flow -> ✅
+  - Direct access grants -> ✅ 
+  - Valid redirect URIs = https://git.coop.tech/*
+  - Valid post logout redirect URIs = https://git.coop.tech/*
+  - Note the client secret under "clients" -> "credentials"
+
+### Settings in forgejo
+
+- Go to https://git.coop.tech/admin 
+- Go to Identity & access
+- Go to Authentication sources
+- Authentication type: OAuth2
+- OAuth2 provider: OpenID Connect
+- Client ID = forgejo
+- Client secret = #see client secrete mentioned above
+- OpenID Connect Auto Discovery URL = https://keycloak.coop.tech/realms/<realm name>/.well-known/openid-configuration