Set up Docker Swarm and abra
Deploy coop-cloud/traefik
abra app new cryptpad --secrets (optionally with --pass if you'd like to save secrets in pass)
abra app config YOURAPPDOMAIN - be sure to change $DOMAIN to something that resolves to your Docker swarm box
abra app deploy YOURAPPDOMAIN
Open the configured domain in your browser to finish set-up

At this point, anyone with this domain can register new users with this cryptpad instance.

After you have registered a first user, here is how you can make this user into an admin. After logging in as your user, go to: https://cryptpad.cctest.autonomic.zone/profile/

Click "Copy Public Key". This will copy your public key into your clipboard. Then run abra app config YOURAPPDOMAIN and set the value of CRYPTPAD_ADMIN_KEYS to include your public key. The example in .env.sample shows the required format.

Then redeploy with abra app deploy YOURAPPDOMAIN --force.

Now when you login as your user, and visit https://cryptpad.cctest.autonomic.zone/admin/, you should be able to access the admin interface for this cryptpad instance.

SSO

SSO support is provided by compose.sso.yml. To enable it, add the SSO compose file and set the SSO variables in your app config:

COMPOSE_FILE="compose.yml:compose.sso.yml"
SSO_ENABLED=true

On the next deploy, the CryptPad SSO plugin will be installed automatically.

You also need to configure the remaining SSO environment variables for your OIDC provider:

SSO_PROVIDER_NAME — display name shown on the login button (e.g. Keycloak, Authentik)
SSO_OIDC_URL — OIDC discovery URL for your provider
SSO_CLIENT_ID — OAuth2 client ID
SSO_JWT_ALG — JWT signing algorithm (e.g. RS256)

The client secret is stored as a Docker secret. Insert it with:

abra app secret insert YOURAPPDOMAIN sso_client_s v1 YOUR_CLIENT_SECRET

Then deploy (or redeploy) to apply: abra app deploy YOURAPPDOMAIN --force.