Instead of Keycloak, I would recommend giving Kanidm a try: It's much more lightweight and covers most of what you usually need (one notable exception being SAML).

https://github.com/kanidm/kanidm

Thanks for the pointer, https://news.ycombinator.com/item?id=47649354

edit: looks like there are affordable managed hosting providers for keycloak.