docs: Add SSO docs

..https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect

.env.sample

@@ -36,3 +36,14 @@ TX="Europe/Berlin"
 #SMTP_DEBUG=true
 
 #DISABLE_IPV6=0
+
+## Single Sign On (OpenID Connect / OIDC) settings
+#COMPOSE_FILE="$COMPOSE_FILE:compose.oidc.yml"
+#SSO_ENABLED=true
+#SSO_ONLY=false
+#SSO_AUTHORITY=https://auth.example.com
+#SSO_SCOPES=profile email offline_access vaultwarden
+#SSO_PKCE=true
+#SSO_CLIENT_ID=vaultwarden
+#SSO_CLIENT_SECRET=insecure_secret
+#SECRET_SSO_SECRET_VERSION=v1

README.md

@@ -3,7 +3,7 @@
 > Open source password manager
 
 <!-- metadata -->
-* **Maintainer**: [@fauno](https://git.coopcloud.tech/fauno), [@ammaratef45](https://git.coopcloud.tech/ammaratef45)
+* **Maintainer**: [@fauno](https://git.coopcloud.tech/fauno), [@ammaratef45](https://git.coopcloud.tech/ammaratef45), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Category**: Apps
 * **Status**: 2, beta
 * **Image**: [`vaultwarden/server`](https://hub.docker.com/vaultwarden/server), 4, upstream
@@ -47,3 +47,7 @@ LOG_LEVEL=warn
 Then follow [this guide](https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup).
 
 And you must use `COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"` in your traefik config to get real IPs.
+
+### Single Sign On with OpenID Connect (OIDC)
+
+Uncomment the "Single Sign On" section in your app config. See the [upstream docs](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for more, including specific configuration examples for Keycloak and Authentik.

abra.sh

@@ -1,4 +1,4 @@
-export APP_ENTRYPOINT_VERSION=v4
+export APP_ENTRYPOINT_VERSION=v5
 APP_DIR="app:/data"
 
 insert_vaultwarden_admin_token() {

compose.oidc.yml

@@ -0,0 +1,20 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - SSO_ENABLED=true
+      - SSO_ONLY
+      - SSO_AUTHORITY
+      - SSO_SCOPES
+      - SSO_PKCE
+      - SSO_CLIENT_ID
+      - SSO_CLIENT_SECRET_FILE=/run/secrets/sso_secret
+    secrets:
+      - sso_secret
+
+secrets:
+  sso_secret:
+    external: true
+    name: ${STACK_NAME}_sso_secret_${SECRET_SSO_SECRET_VERSION}

compose.yml

@@ -45,7 +45,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=2.3.2+1.37.2"
+        - "coop-cloud.${STACK_NAME}.version=2.3.3+1.37.2"
         - "backupbot.backup=true"
         - "backupbot.backup.path=/data"
 

entrypoint.sh.tmpl

@@ -52,6 +52,10 @@ file_env "ADMIN_TOKEN"
 file_env "SMTP_PASSWORD"
 {{ end }}
 
+{{ if eq (env "SSO_ENABLED") "true" }}
+file_env "SSO_CLIENT_SECRET"
+{{ end }}
+
 # remove world permissions on data
 chmod -R o= /data
 

renovate.json

@@ -5,6 +5,9 @@
   ],
   "reviewers": [
     "ammaratef45",
-    "fauno"
+    "fauno",
+    "moritz",
+    "simon",
+    "carla"
   ]
 }