diff --git a/roles/keycloak/tasks/main.yml b/roles/keycloak/tasks/main.yml
index ce8b8b5..c6bf0b9 100644
--- a/roles/keycloak/tasks/main.yml
+++ b/roles/keycloak/tasks/main.yml
@@ -8,6 +8,7 @@
 
 - include_tasks: tasks/install.yml
 
+## FIXME not idempotent (keyclock removes the file when it restarts)
 - name: create Keycloak admin user
   command:
   args:
diff --git a/roles/keycloak/tasks/systemd.yml b/roles/keycloak/tasks/systemd.yml
index 67fd2e1..8584c2e 100644
--- a/roles/keycloak/tasks/systemd.yml
+++ b/roles/keycloak/tasks/systemd.yml
@@ -38,12 +38,30 @@
     daemon_reload: yes
   when: systemdunit.changed
 
-- name: start keycloak
-  systemd:
-    name: keycloak
-    enabled: yes
-    state: started
-  become: yes
+- block:
+    - name: start keycloak
+      systemd:
+        name: keycloak
+        enabled: yes
+        state: started
+      become: yes
+  rescue:
+    - command: "systemctl status keycloak"
+      changed_when: False
+      ignore_errors: True
+    - command: "journalctl -xe -ukeycloak"
+      changed_when: False
+      ignore_errors: True
+    - command: "tail -n 100 /opt/keycloak/keycloak.log"
+      changed_when: False
+      ignore_errors: True
+    - debug:
+        msg: "Virt type: {{ ansible_facts.virtualization_type }}"
+      changed_when: False
+      ignore_errors: True
+    - command: "cat /opt/keycloak/keycloak-service.sh"
+      changed_when: False
+      ignore_errors: True
 
 - command: "systemctl status keycloak"
   register: keycloak_service_status
diff --git a/roles/keycloak/templates/keycloak-sysconfig.j2 b/roles/keycloak/templates/keycloak-sysconfig.j2
index d0682ac..f2eda03 100644
--- a/roles/keycloak/templates/keycloak-sysconfig.j2
+++ b/roles/keycloak/templates/keycloak-sysconfig.j2
@@ -5,3 +5,5 @@ KEYCLOAK_HTTP_PORT={{ keycloak_http_port }}
 KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }}
 KEYCLOAK_MANAGEMENT_HTTP_PORT={{ keycloak_management_http_port }}
 KEYCLOAK_MANAGEMENT_HTTPS_PORT={{ keycloak_management_https_port }}
+JBOSS_PIDFILE='{{ keycloak_service_pidfile }}'
+LAUNCH_JBOSS_IN_BACKGROUND=1
\ No newline at end of file
diff --git a/roles/keycloak/templates/keycloak.service.j2 b/roles/keycloak/templates/keycloak.service.j2
index a56acce..4c55da6 100644
--- a/roles/keycloak/templates/keycloak.service.j2
+++ b/roles/keycloak/templates/keycloak.service.j2
@@ -11,7 +11,7 @@ Group={{ keycloak_service_group }}
 PIDFile={{ keycloak_service_pidfile }}
 ExecStart={{ keycloak_dest }}/keycloak-service.sh start
 ExecStop={{ keycloak_dest }}/keycloak-service.sh stop
-TimeoutStartSec=30
+TimeoutStartSec=45
 TimeoutStopSec=30
 LimitNOFILE=102642