add sso to readme

Reviewed-on: #5

.env.sample

@@ -16,3 +16,13 @@ SANDBOX_DOMAIN=sandbox.cryptpad.example.com
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.cryptpad.example.com`'
 LETS_ENCRYPT_ENV=production
+
+## SSO / OIDC (optional — defaults to false)
+#SSO_ENABLED=true
+#SSO_ENFORCED=false
+#SSO_PROVIDER_NAME=Authentik
+#SSO_OIDC_URL=https://authentik.example.com/application/o/cryptpad
+#SSO_CLIENT_ID=cryptpad
+#SSO_CLIENT_SECRET_VERSION=v1
+#SSO_JWT_ALG=RS256
+#SSO_PLUGIN_VERSION=0.4.0

README.md

@@ -5,13 +5,13 @@
 <!-- metadata -->
 
 * **Category**: Apps
-* **Status**: 0
+* **Status**: 3
 * **Image**: cryptpad/cryptpad
-* **Healthcheck**: No
-* **Backups**: No
+* **Healthcheck**: Yes
+* **Backups**: Yes
 * **Email**: No
 * **Tests**: No
-* **SSO**: No
+* **SSO**: Yes
 
 <!-- endmetadata -->
 
@@ -40,5 +40,24 @@ Then redeploy with `abra app deploy YOURAPPDOMAIN --force`.
 Now when you login as your user, and visit https://cryptpad.cctest.autonomic.zone/admin/,
 you should be able to access the admin interface for this cryptpad instance. 
 
+## SSO
+
+To enable SSO, run `abra app config YOURAPPDOMAIN` and set `SSO_ENABLED=true`. On the next deploy, the [CryptPad SSO plugin](https://github.com/cryptpad/sso) will be installed automatically.
+
+You also need to configure the remaining SSO environment variables for your OIDC provider:
+
+- `SSO_PROVIDER_NAME` — display name shown on the login button (e.g. `Keycloak`, `Authentik`)
+- `SSO_OIDC_URL` — OIDC discovery URL for your provider
+- `SSO_CLIENT_ID` — OAuth2 client ID
+- `SSO_JWT_ALG` — JWT signing algorithm (e.g. `RS256`)
+
+The client secret is stored as a Docker secret. Insert it with:
+
+```
+abra app secret insert YOURAPPDOMAIN sso_client_s v1 YOUR_CLIENT_SECRET
+```
+
+Then deploy (or redeploy) to apply: `abra app deploy YOURAPPDOMAIN --force`.
+
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
 [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1,3 +1,5 @@
 export CONFIG_VERSION=v2
 export CONFIG_JS_VERSION=v2
 export NGINX_CONF_VERSION=v1
+export SSO_ENTRYPOINT_VERSION=v6
+export SSO_JS_VERSION=v3

compose.yml

@@ -3,7 +3,9 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2025.9.0
+    image: cryptpad/cryptpad:version-2026.2.0
+    entrypoint: ["/sso-entrypoint.sh", "/cryptpad/docker-entrypoint.sh"]
+    command: ["npm", "start"]
     networks:
       - backend
     environment:
@@ -15,7 +17,16 @@ services:
       - "CPAD_HTTP2_DISABLE=true"
       - "CPAD_TRUST_PROXY=1"
       - "CPAD_CONF=/cryptpad/config/config.js"
-
+      # SSO plugin
+      - SSO_PLUGIN_VERSION
+      - "SSO_ENABLED=${SSO_ENABLED:-false}"
+      - SSO_ENFORCED
+      - SSO_PROVIDER_NAME
+      - SSO_OIDC_URL
+      - SSO_CLIENT_ID
+      - SSO_JWT_ALG
+    secrets:
+      - sso_client_s
     volumes:
       - cryptpad_blob:/cryptpad/blob
       - cryptpad_block:/cryptpad/block
@@ -23,9 +34,15 @@ services:
       - cryptpad_data:/cryptpad/data
       - cryptpad_files:/cryptpad/datastore
       - cryptpad_config:/cryptpad/config/
+      - cryptpad_plugins:/cryptpad/lib/plugins
     configs:
       - source: config_js
         target: /cryptpad/config/config.js
+      - source: sso_entrypoint
+        target: /sso-entrypoint.sh
+        mode: 0755
+      - source: sso_js
+        target: /sso.js
 
     deploy:
       restart_policy:
@@ -33,16 +50,17 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.1+version-2025.9.0"
-    # healthcheck:
-    #   test: ["CMD", "curl", "-f", "http://localhost"]
-    #   interval: 30s
-    #   timeout: 10s
-    #   retries: 10
-    #   start_period: 1m
+        - "coop-cloud.${STACK_NAME}.version=0.5.1+v2026.2.0"
+        - "backupbot.backup=true"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 1m
 
   web:
-    image: nginx:1.25
+    image: nginx:1.29
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf
@@ -75,6 +93,12 @@ volumes:
   cryptpad_data:
   cryptpad_files:
   cryptpad_config:
+  cryptpad_plugins:
+
+secrets:
+  sso_client_s:
+    external: true
+    name: ${STACK_NAME}_sso_client_s_${SSO_CLIENT_SECRET_VERSION}
 
 configs:
   config_js:
@@ -85,3 +109,10 @@ configs:
     name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
     file: nginx.conf.tmpl
     template_driver: golang
+  sso_entrypoint:
+    name: ${STACK_NAME}_sso_entrypoint_${SSO_ENTRYPOINT_VERSION}
+    file: sso-entrypoint.sh
+  sso_js:
+    name: ${STACK_NAME}_sso_js_${SSO_JS_VERSION}
+    file: sso.js.tmpl
+    template_driver: golang

sso-entrypoint.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+
+# SSO plugin installer — runs before the original CryptPad entrypoint.
+# Clones the cryptpad/sso plugin into the plugins volume if not already present
+# or if the version has changed.
+
+# Skips SSO setup entirely when SSO_ENABLED is not "true".
+if [ "${SSO_ENABLED}" != "true" ]; then
+  echo "[sso-entrypoint] SSO not enabled, skipping plugin install"
+  exec "$@"
+fi
+
+PLUGIN_DIR="/cryptpad/lib/plugins/sso"
+VERSION_FILE="${PLUGIN_DIR}/.version"
+SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}"
+
+# Copy SSO config template into place (mounted as Docker config)
+if [ -f /sso.js ]; then
+  cp /sso.js /cryptpad/config/sso.js
+  echo "[sso-entrypoint] Copied sso.js config into /cryptpad/config/sso.js"
+fi
+
+# Install/update the SSO plugin
+if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then
+  echo "[sso-entrypoint] SSO plugin ${SSO_PLUGIN_VERSION} already installed"
+else
+  echo "[sso-entrypoint] Installing SSO plugin ${SSO_PLUGIN_VERSION} ..."
+  rm -rf "${PLUGIN_DIR}"
+  git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \
+    https://github.com/cryptpad/sso.git "${PLUGIN_DIR}"
+  echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}"
+  echo "[sso-entrypoint] SSO plugin installed"
+fi
+
+# Hand off to the original CryptPad entrypoint
+exec "$@"

sso.js.tmpl

@@ -0,0 +1,21 @@
+// CryptPad SSO configuration — generated from environment variables
+// See https://github.com/cryptpad/sso for documentation
+
+module.exports = {
+    enabled: "{{ env "SSO_ENABLED" }}" === "true",
+    enforced: "{{ env "SSO_ENFORCED" }}" === "true",
+    cpPassword: true,
+    forceCpPassword: false,
+    list: [
+        {
+            name: "{{ env "SSO_PROVIDER_NAME" }}",
+            type: "oidc",
+            url: "{{ env "SSO_OIDC_URL" }}",
+            client_id: "{{ env "SSO_CLIENT_ID" }}",
+            client_secret: "{{ secret "sso_client_s" }}",
+            id_token_alg: "{{ env "SSO_JWT_ALG" }}",
+            use_pkce: true,
+            use_nonce: true
+        }
+    ]
+};