Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Convert Nextcloud and Pingvin to steps

Browse Source
This commit is contained in:
Djeex
2026-09-04 15:14:12 +02:00
parent a7b85af45a
commit cd75fd2288
4 changed files with 79 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/9.apps/2.vaultwarden.md
+22 -11
View File
@@ -5,11 +5,6 @@ description: Install Vaultwarden, a self-hosted Bitwarden-compatible password ma
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
# Vaultwarden
::note
🎯 __Goals:__ Install [Vaultwarden](https://github.com/dani-garcia/vaultwarden) to manage your passwords across all your devices (a replacement for Google or Apple password managers).
::
![Vaultwarden](/img/serveex/vaultwarden.png)
@@ -107,8 +102,8 @@ __If it fails:__ check your firewall rules.
## Exposing Vaultwarden with SWAG
The main benefit of Vaultwarden is being able to access it remotely from any device. We'll expose it through [SWAG](/serveex/core/swag).
::note
✨ __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
::note{icon=""}
📋 __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
::
In Dockge, go to the SWAG stack and edit the compose file to add the Vaultwarden network:
@@ -293,12 +288,22 @@ Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will pro
See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies.
::
::tip{icon=""}
::::tip{icon=""}
✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
1. In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
2. Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
3. Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
:::collapsible{name="the Authentik setup steps"}
::steps{level="4"}
#### Create a scope mapping for the email claim
In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
#### Create the application and provider
Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
#### Set Vaultwarden's environment variables
Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
```properties [.env]
SSO_AUTHORITY=https://authentik.yourdomain.com/application/o/<slug>/
@@ -306,4 +311,10 @@ SSO_CLIENT_ID=
SSO_CLIENT_SECRET=
SSO_SCOPES=email profile offline_access
```
#### Done !
::
:::
::::