The lib/quarkus directory must be writeable.

tasks/keycloak-install.yml

@@ -34,6 +34,15 @@
       mode: 0750
     tags: [ keycloak, keycloak_data_dir ]
 
+  - name: Set the permissions of the {{ keycloak_runtime_home }}/lib/quarkus directory 
+    ansible.builtin.file:
+      dest: '{{ keycloak_runtime_home }}/lib/quarkus'
+      state: directory
+      owner: '{{ keycloak_user }}'
+      group: '{{ keycloak_user }}'
+      mode: 0750
+    tags: [ keycloak, keycloak_data_dir ]
+
   - name: Avatar directory
     ansible.builtin.file:
       dest: '{{ keycloak_external_avatar_dir }}'

templates/keycloak.service.j2

@@ -20,7 +20,7 @@ User={{ keycloak_user }}
 Group={{ keycloak_user }}
 SuccessExitStatus=0 143
 UMask=0027
-ExecStart={{ keycloak_runtime_home }}/bin/kc.sh start{% if not keycloak_optimize_build_at_startup %} --optimized{% endif %}{% if keycloak_disabled_features != "" %} --features-disabled={% for dis in keycloak_disabled_features %}{{ dis }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}{% if keycloak_preview_features != "" %} --features=={% for feat in --features= %}{{ feat }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}{% if keycloak_upgrade_db_at_startup %} --spi-connections-jpa-default-migration-strategy=update{% endif %}
+ExecStart={{ keycloak_runtime_home }}/bin/kc.sh start{% if not keycloak_optimize_build_at_startup %} --optimized{% endif %}{% if keycloak_disabled_features | length %} --features-disabled={% for dis in keycloak_disabled_features %}{{ dis }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}{% if keycloak_preview_features | length  %} --features={% for feat in keycloak_preview_features %}{{ feat }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}{% if keycloak_upgrade_db_at_startup %} --spi-connections-jpa-default-migration-strategy=update{% endif %}
 
 [Install]
 WantedBy=multi-user.target