As someone who has managed keycloak in production for work, it's a solid solution but boy is it easy to make mistakes that cause difficult to debug issues. It's a headache that does what it says on the tin.
I only briefly used Keycloak at my "home lab" (a SBC with traefik and few services) and felt nice: it had that feature of syncing with ldap, which I believe makes it special in that space