Add native Pocket ID OIDC tutorials across the app guides

content/en/3.serveex/6.cloud/1.immich.md

@@ -88,7 +88,7 @@ In the SWAG folders, create a file named `immich.subdomain.conf`.
 
 ::tip{icon=""}
 
-✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
+✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -159,6 +159,39 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 
 That's it! Immich is now accessible from the internet. Don’t forget to install the [iOS](https://apps.apple.com/us/app/immich/id1613945652) / [Android](https://play.google.com/store/apps/details?id=app.alextran.immich) apps to sync your devices.
 
-::tip{icon=""}
+## Protecting Immich with Pocket ID
-✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/immich/).
+Immich supports OIDC natively, so you can require a Pocket ID login before letting anyone into your photos, instead of (or alongside) the app's own accounts.
+
+::steps{level="3"}
+### Register Immich as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `immich`, with these three callback URLs:
+
+```text
+https://immich.yourdomain.com/auth/login
+https://immich.yourdomain.com/user-settings
+app.immich:///oauth-callback
+```
+
+The third URL is what lets the mobile app log in too.
+
+### Enable OAuth in Immich
+
+In Immich, go to _Administration > Settings > Authentication Settings > OAuth_, enable it, and fill in:
+
+| Field | Value |
+|-------|-------|
+| Issuer URL | Pocket ID's OIDC discovery URL |
+| Client ID | The client ID copied from Pocket ID |
+| Client Secret | The client secret copied from Pocket ID |
+
+### Done !
+::
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+
+1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `immich`, with the same three redirect URIs as above (type `Strict`).
+2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
+3. In Immich's OAuth settings, set the Issuer URL to `https://authentik.yourdomain.com/application/o/<slug>/`, then fill in the Client ID and Client Secret.
 ::

content/en/3.serveex/6.cloud/2.nextcloud.md

@@ -119,7 +119,7 @@ Redeploy the stack and wait for SWAG to become fully operational.
 In Nextcloud’s files, edit the `config.php` file:
 
 ::tip{icon=""}
-✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -190,6 +190,41 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 
 That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
 
-::tip{icon=""}
+## Protecting Nextcloud with Pocket ID
-✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/nextcloud/).
+Nextcloud can also delegate login to an OIDC provider instead of (or alongside) its own accounts.
+
+::steps{level="3"}
+### Install the OpenID Connect app
+
+In Nextcloud, go to _Apps > Integration_ and install __OpenID Connect user backend__ (`user_oidc`).
+
+### Register Nextcloud as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Nextcloud`, with this callback URL:
+
+```text
+https://nextcloud.yourdomain.com/apps/user_oidc/code
+```
+
+### Add the provider in Nextcloud
+
+In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and fill in:
+
+| Field | Value |
+|-------|-------|
+| Identifier | `PocketID` |
+| Client ID | The client ID copied from Pocket ID |
+| Client secret | The client secret copied from Pocket ID |
+| Discovery endpoint | Pocket ID's OIDC discovery URL |
+| Scope | `openid email profile groups` |
+
+### Done !
+::
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+
+1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`.
+2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
+3. In Nextcloud's OpenID Connect settings, set the Discovery endpoint to `https://authentik.yourdomain.com/application/o/<slug>/.well-known/openid-configuration`, then fill in the Client ID and Client Secret.
 ::

content/en/3.serveex/7.files/2.pingvin.md

@@ -116,7 +116,7 @@ In the Swag folders, create the `pingvin.subdomain.conf` file.
 
 ::tip{icon=""}
 
-✨ __Tip:__ you can use [File Browser](/serveex/files/file-browser) to browse your files and edit your documents instead of using terminal commands.
+✨ __Tip:__ you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse your files and edit your documents instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -180,9 +180,35 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 
 That's it, you've exposed Pingvin!
 
-## Securing Pingvin with Authentik
+## Protecting Pingvin with Pocket ID
+Pingvin supports OIDC natively, so you can require a Pocket ID login before letting anyone share or receive files, instead of (or alongside) the app's own accounts.
 
-You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) instead (register Pingvin as an OIDC client there, then fill in Pingvin's OAuth settings the same way as step 6 below), or with Authentik by following the instructions below.
+::steps{level="3"}
+### Register Pingvin as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `pingvin`, with this callback URL:
+
+```text
+https://pingvin.yourdomain.com/api/oauth/callback/oidc
+```
+
+### Enable Social Login in Pingvin
+
+In Pingvin, go to _Administration > Configuration > Social Login_ and fill in:
+
+| Field | Value |
+|-------|-------|
+| OpenID Connect | Enabled |
+| Discovery URI | Pocket ID's OIDC discovery URL |
+| Scope | `openid email profile groups` |
+
+### Done !
+::
+
+That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
 
 1. In your Authentik admin area, create an OAuth2/OpenID provider.
 
@@ -205,5 +231,4 @@ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/po
 - `OpenID username claim` with `preferred_username`
 - `OpenID client ID` with the ID you copied in step 2.
 - `OpenID client secret` with the token you copied in step 2.
-
+::
-That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.

content/en/3.serveex/8.development/2.forgejo.md

@@ -106,7 +106,7 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational
 Inside the Swag folders, create the file `forgejo.subdomain.conf`.
 
 ::tip{icon=""}
-✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
+✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -192,6 +192,45 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 
 And that’s it! Forgejo is now exposed to the web.
 
-::tip{icon=""}
+## Protecting Forgejo with Pocket ID
-✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://integrations.goauthentik.io/development/forgejo/).
+Forgejo can also delegate login to an OIDC provider instead of (or alongside) its own accounts.
+
+::steps{level="3"}
+### Register Forgejo as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Forgejo`, with this callback URL:
+
+```text
+https://forgejo.yourdomain.com/user/oauth2/PocketID/callback
+```
+
+::note
+The `PocketID` in the callback URL must match the __Authentication Name__ you set in the next step, exactly.
+::
+
+### Add the authentication source in Forgejo
+
+As an admin, go to _Site Administration > Identity & Access > Authentication Sources_, click _Add Authentication Source_, and fill in:
+
+| Field | Value |
+|-------|-------|
+| Authentication Type | `OAuth2` |
+| Authentication Name | `PocketID` |
+| OAuth2 Provider | `OpenID Connect` |
+| Client ID (Key) | The client ID copied from Pocket ID |
+| Client Secret | The client secret copied from Pocket ID |
+| OIDC Discovery URL | Pocket ID's OIDC discovery URL |
+| Additional Scopes | `openid email profile` |
+
+Also enable __Skip local 2FA__.
+
+### Done !
+::
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+
+1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Forgejo`, with a redirect URI (type `Strict`) of `https://forgejo.yourdomain.com/user/oauth2/authentik/callback`.
+2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
+3. In Forgejo's authentication source, set __Authentication Name__ to `authentik`, __OIDC Discovery URL__ to `https://authentik.yourdomain.com/application/o/<slug>/.well-known/openid-configuration`, then fill in the Client ID, Client Secret, and Additional Scopes `email profile`.
 ::

content/en/3.serveex/9.apps/2.vaultwarden.md

@@ -142,7 +142,7 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational
 In SWAG's config folder, create the file `vault.subdomain.conf`:
 
 ::tip{icon=""}
-✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
 ::
 
 ```bash [Terminal]
@@ -241,6 +241,71 @@ And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.co
 
 Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords.
 
-::tip{icon=""}
+## Protecting Vaultwarden with Pocket ID
-✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `tools.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+Unlike most apps on this site, Vaultwarden supports OIDC natively, so there's no need for TinyAuth's forward-auth proxy or Authentik's reverse-proxy trick here: Vaultwarden itself can require an OIDC login before letting anyone into the vault.
+
+::steps{level="3"}
+### Register Vaultwarden as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) (or in Authentik, or any other OIDC provider) using this callback URL:
+
+```text
+https://vault.yourdomain.com/identity/connect/oidc-signin
+```
+
+### Add the SSO variables
+
+Edit Vaultwarden's `.env` file:
+
+```bash [Terminal]
+sudo nano /docker/vaultwarden/.env
+```
+
+Add the following:
+
+```properties [.env]
+SSO_ENABLED=true
+SSO_ONLY=true
+SSO_AUTHORITY=https://id.yourdomain.com
+SSO_CLIENT_ID=
+SSO_CLIENT_SECRET=
+```
+
+| Variable | Value |
+|----------|-------|
+| `SSO_AUTHORITY`{lang=properties} | Your OIDC provider's public URL (Pocket ID here) |
+| `SSO_CLIENT_ID`{lang=properties} | The client ID copied from your provider |
+| `SSO_CLIENT_SECRET`{lang=properties} | The client secret copied from your provider |
+
+::note
+
+Set `SSO_ONLY=false` instead if you'd rather keep the option to log in with a local master password too.
+::
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+### Redeploy the stack
+
+Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will prompt for SSO login instead of (or alongside) the local master password.
+
+### Done !
+::
+
+::note
+See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies.
+::
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+
+1. In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
+2. Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
+3. Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
+
+```properties [.env]
+SSO_AUTHORITY=https://authentik.yourdomain.com/application/o/<slug>/
+SSO_CLIENT_ID=
+SSO_CLIENT_SECRET=
+SSO_SCOPES=email profile offline_access
+```
 ::