Debian package with configurable authentication proxy that uses an X509 client certificate to authenticate against keycloak. If successfully authenticated it will put an OAuth access token on the request header for the upstream service to validate.