diff --git a/content/en/3.serveex/6.cloud/1.immich.md b/content/en/3.serveex/6.cloud/1.immich.md index e240348..edd6c88 100644 --- a/content/en/3.serveex/6.cloud/1.immich.md +++ b/content/en/3.serveex/6.cloud/1.immich.md @@ -88,7 +88,7 @@ In the SWAG folders, create a file named `immich.subdomain.conf`. ::tip{icon=""} -✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands. +✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands. :: ```bash [Terminal] @@ -159,6 +159,39 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct That's it! Immich is now accessible from the internet. Don’t forget to install the [iOS](https://apps.apple.com/us/app/immich/id1613945652) / [Android](https://play.google.com/store/apps/details?id=app.alextran.immich) apps to sync your devices. -::tip{icon=""} -✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/immich/). +## Protecting Immich with Pocket ID +Immich supports OIDC natively, so you can require a Pocket ID login before letting anyone into your photos, instead of (or alongside) the app's own accounts. + +::steps{level="3"} +### Register Immich as an OIDC client + +[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `immich`, with these three callback URLs: + +```text +https://immich.yourdomain.com/auth/login +https://immich.yourdomain.com/user-settings +app.immich:///oauth-callback +``` + +The third URL is what lets the mobile app log in too. + +### Enable OAuth in Immich + +In Immich, go to _Administration > Settings > Authentication Settings > OAuth_, enable it, and fill in: + +| Field | Value | +|-------|-------| +| Issuer URL | Pocket ID's OIDC discovery URL | +| Client ID | The client ID copied from Pocket ID | +| Client Secret | The client secret copied from Pocket ID | + +### Done ! +:: + +::tip +✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: + +1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `immich`, with the same three redirect URIs as above (type `Strict`). +2. Note the provider's __Client ID__, __Client Secret__, and __Slug__. +3. In Immich's OAuth settings, set the Issuer URL to `https://authentik.yourdomain.com/application/o//`, then fill in the Client ID and Client Secret. :: diff --git a/content/en/3.serveex/6.cloud/2.nextcloud.md b/content/en/3.serveex/6.cloud/2.nextcloud.md index 81803df..b5f1eb1 100644 --- a/content/en/3.serveex/6.cloud/2.nextcloud.md +++ b/content/en/3.serveex/6.cloud/2.nextcloud.md @@ -119,7 +119,7 @@ Redeploy the stack and wait for SWAG to become fully operational. In Nextcloud’s files, edit the `config.php` file: ::tip{icon=""} -✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands. +✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands. :: ```bash [Terminal] @@ -190,6 +190,41 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/). -::tip{icon=""} -✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/nextcloud/). +## Protecting Nextcloud with Pocket ID +Nextcloud can also delegate login to an OIDC provider instead of (or alongside) its own accounts. + +::steps{level="3"} +### Install the OpenID Connect app + +In Nextcloud, go to _Apps > Integration_ and install __OpenID Connect user backend__ (`user_oidc`). + +### Register Nextcloud as an OIDC client + +[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Nextcloud`, with this callback URL: + +```text +https://nextcloud.yourdomain.com/apps/user_oidc/code +``` + +### Add the provider in Nextcloud + +In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and fill in: + +| Field | Value | +|-------|-------| +| Identifier | `PocketID` | +| Client ID | The client ID copied from Pocket ID | +| Client secret | The client secret copied from Pocket ID | +| Discovery endpoint | Pocket ID's OIDC discovery URL | +| Scope | `openid email profile groups` | + +### Done ! +:: + +::tip +✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: + +1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`. +2. Note the provider's __Client ID__, __Client Secret__, and __Slug__. +3. In Nextcloud's OpenID Connect settings, set the Discovery endpoint to `https://authentik.yourdomain.com/application/o//.well-known/openid-configuration`, then fill in the Client ID and Client Secret. :: diff --git a/content/en/3.serveex/7.files/2.pingvin.md b/content/en/3.serveex/7.files/2.pingvin.md index 529f6f2..e932ece 100644 --- a/content/en/3.serveex/7.files/2.pingvin.md +++ b/content/en/3.serveex/7.files/2.pingvin.md @@ -116,7 +116,7 @@ In the Swag folders, create the `pingvin.subdomain.conf` file. ::tip{icon=""} -✨ __Tip:__ you can use [File Browser](/serveex/files/file-browser) to browse your files and edit your documents instead of using terminal commands. +✨ __Tip:__ you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse your files and edit your documents instead of using terminal commands. :: ```bash [Terminal] @@ -180,9 +180,35 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct That's it, you've exposed Pingvin! -## Securing Pingvin with Authentik +## Protecting Pingvin with Pocket ID +Pingvin supports OIDC natively, so you can require a Pocket ID login before letting anyone share or receive files, instead of (or alongside) the app's own accounts. -You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) instead (register Pingvin as an OIDC client there, then fill in Pingvin's OAuth settings the same way as step 6 below), or with Authentik by following the instructions below. +::steps{level="3"} +### Register Pingvin as an OIDC client + +[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `pingvin`, with this callback URL: + +```text +https://pingvin.yourdomain.com/api/oauth/callback/oidc +``` + +### Enable Social Login in Pingvin + +In Pingvin, go to _Administration > Configuration > Social Login_ and fill in: + +| Field | Value | +|-------|-------| +| OpenID Connect | Enabled | +| Discovery URI | Pocket ID's OIDC discovery URL | +| Scope | `openid email profile groups` | + +### Done ! +:: + +That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form. + +::tip +✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: 1. In your Authentik admin area, create an OAuth2/OpenID provider. @@ -205,5 +231,4 @@ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/po - `OpenID username claim` with `preferred_username` - `OpenID client ID` with the ID you copied in step 2. - `OpenID client secret` with the token you copied in step 2. - -That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form. +:: diff --git a/content/en/3.serveex/8.development/2.forgejo.md b/content/en/3.serveex/8.development/2.forgejo.md index 0e44c5c..915bb84 100644 --- a/content/en/3.serveex/8.development/2.forgejo.md +++ b/content/en/3.serveex/8.development/2.forgejo.md @@ -106,7 +106,7 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational Inside the Swag folders, create the file `forgejo.subdomain.conf`. ::tip{icon=""} -✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands. +✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands. :: ```bash [Terminal] @@ -192,6 +192,45 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct And that’s it! Forgejo is now exposed to the web. -::tip{icon=""} -✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://integrations.goauthentik.io/development/forgejo/). +## Protecting Forgejo with Pocket ID +Forgejo can also delegate login to an OIDC provider instead of (or alongside) its own accounts. + +::steps{level="3"} +### Register Forgejo as an OIDC client + +[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Forgejo`, with this callback URL: + +```text +https://forgejo.yourdomain.com/user/oauth2/PocketID/callback +``` + +::note +The `PocketID` in the callback URL must match the __Authentication Name__ you set in the next step, exactly. +:: + +### Add the authentication source in Forgejo + +As an admin, go to _Site Administration > Identity & Access > Authentication Sources_, click _Add Authentication Source_, and fill in: + +| Field | Value | +|-------|-------| +| Authentication Type | `OAuth2` | +| Authentication Name | `PocketID` | +| OAuth2 Provider | `OpenID Connect` | +| Client ID (Key) | The client ID copied from Pocket ID | +| Client Secret | The client secret copied from Pocket ID | +| OIDC Discovery URL | Pocket ID's OIDC discovery URL | +| Additional Scopes | `openid email profile` | + +Also enable __Skip local 2FA__. + +### Done ! +:: + +::tip +✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: + +1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Forgejo`, with a redirect URI (type `Strict`) of `https://forgejo.yourdomain.com/user/oauth2/authentik/callback`. +2. Note the provider's __Client ID__, __Client Secret__, and __Slug__. +3. In Forgejo's authentication source, set __Authentication Name__ to `authentik`, __OIDC Discovery URL__ to `https://authentik.yourdomain.com/application/o//.well-known/openid-configuration`, then fill in the Client ID, Client Secret, and Additional Scopes `email profile`. :: diff --git a/content/en/3.serveex/9.apps/2.vaultwarden.md b/content/en/3.serveex/9.apps/2.vaultwarden.md index 76921c6..3215698 100644 --- a/content/en/3.serveex/9.apps/2.vaultwarden.md +++ b/content/en/3.serveex/9.apps/2.vaultwarden.md @@ -142,7 +142,7 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational In SWAG's config folder, create the file `vault.subdomain.conf`: ::tip{icon=""} -✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands. +✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands. :: ```bash [Terminal] @@ -241,6 +241,71 @@ And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.co Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords. -::tip{icon=""} -✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `tools.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). +## Protecting Vaultwarden with Pocket ID +Unlike most apps on this site, Vaultwarden supports OIDC natively, so there's no need for TinyAuth's forward-auth proxy or Authentik's reverse-proxy trick here: Vaultwarden itself can require an OIDC login before letting anyone into the vault. + +::steps{level="3"} +### Register Vaultwarden as an OIDC client + +[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) (or in Authentik, or any other OIDC provider) using this callback URL: + +```text +https://vault.yourdomain.com/identity/connect/oidc-signin +``` + +### Add the SSO variables + +Edit Vaultwarden's `.env` file: + +```bash [Terminal] +sudo nano /docker/vaultwarden/.env +``` + +Add the following: + +```properties [.env] +SSO_ENABLED=true +SSO_ONLY=true +SSO_AUTHORITY=https://id.yourdomain.com +SSO_CLIENT_ID= +SSO_CLIENT_SECRET= +``` + +| Variable | Value | +|----------|-------| +| `SSO_AUTHORITY`{lang=properties} | Your OIDC provider's public URL (Pocket ID here) | +| `SSO_CLIENT_ID`{lang=properties} | The client ID copied from your provider | +| `SSO_CLIENT_SECRET`{lang=properties} | The client secret copied from your provider | + +::note + +Set `SSO_ONLY=false` instead if you'd rather keep the option to log in with a local master password too. +:: + +Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. + +### Redeploy the stack + +Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will prompt for SSO login instead of (or alongside) the local master password. + +### Done ! +:: + +::note +See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies. +:: + +::tip +✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: + +1. In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim). +2. Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping. +3. Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`: + +```properties [.env] +SSO_AUTHORITY=https://authentik.yourdomain.com/application/o// +SSO_CLIENT_ID= +SSO_CLIENT_SECRET= +SSO_SCOPES=email profile offline_access +``` ::