da5652aa10
- Add SSO environment variables to template.yaml (SSO_ENABLED, SSO_ONLY,
SSO_AUTHORITY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_SCOPES, SSO_PKCE,
SSO_AUDIENCE_TRUSTED)
- Add SSO variables to .env.sample with Zitadel audience quirk explained
- Document full Zitadel setup in README: app creation, redirect URI, OIDC
settings, and the audience fix (SSO_AUDIENCE_TRUSTED=^\d{18}$)
- Update .gitignore to track .env.sample files in docker-compose-files
51 lines
2.1 KiB
YAML
51 lines
2.1 KiB
YAML
services:
|
|
vaultwarden:
|
|
image: vaultwarden/server:{{VAULTWARDEN_VERSION:-latest}}
|
|
container_name: vaultwarden
|
|
restart: unless-stopped
|
|
environment:
|
|
TZ: "{{TZ}}"
|
|
DOMAIN: "{{VAULTWARDEN_DOMAIN}}"
|
|
SIGNUPS_ALLOWED: "{{VAULTWARDEN_SIGNUPS_ALLOWED:-false}}"
|
|
# Admin panel at /admin — set to an argon2 hash; leave blank to disable
|
|
ADMIN_TOKEN: "{{VAULTWARDEN_ADMIN_TOKEN:-}}"
|
|
# Email (optional — leave all blank to disable)
|
|
SMTP_HOST: "{{EMAIL_HOST:-}}"
|
|
SMTP_FROM: "{{VAULTWARDEN_SMTP_FROM:-}}"
|
|
SMTP_PORT: "{{EMAIL_PORT:-587}}"
|
|
SMTP_SECURITY: "{{VAULTWARDEN_SMTP_SECURITY:-starttls}}"
|
|
SMTP_USERNAME: "{{EMAIL_HOST_USER:-}}"
|
|
SMTP_PASSWORD: "{{EMAIL_HOST_PASSWORD:-}}"
|
|
# Mobile push notifications (register at https://bitwarden.com/host/)
|
|
PUSH_ENABLED: "{{VAULTWARDEN_PUSH_ENABLED:-false}}"
|
|
PUSH_INSTALLATION_ID: "{{VAULTWARDEN_PUSH_ID:-}}"
|
|
PUSH_INSTALLATION_KEY: "{{VAULTWARDEN_PUSH_KEY:-}}"
|
|
# SSO via OIDC (optional — leave SSO_AUTHORITY blank to disable)
|
|
SSO_ENABLED: "{{VAULTWARDEN_SSO_ENABLED:-false}}"
|
|
SSO_ONLY: "{{VAULTWARDEN_SSO_ONLY:-false}}"
|
|
SSO_AUTHORITY: "{{VAULTWARDEN_SSO_AUTHORITY:-}}"
|
|
SSO_CLIENT_ID: "{{VAULTWARDEN_SSO_CLIENT_ID:-}}"
|
|
SSO_CLIENT_SECRET: "{{VAULTWARDEN_SSO_CLIENT_SECRET:-}}"
|
|
SSO_SCOPES: "{{VAULTWARDEN_SSO_SCOPES:-openid email profile offline_access}}"
|
|
SSO_PKCE: "{{VAULTWARDEN_SSO_PKCE:-true}}"
|
|
# Zitadel puts all project app client IDs in aud; trust any 18-digit ID
|
|
SSO_AUDIENCE_TRUSTED: "{{VAULTWARDEN_SSO_AUDIENCE_TRUSTED:-}}"
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- vaultwarden_data:/data
|
|
ports:
|
|
- "{{VAULTWARDEN_BIND_IP:-0.0.0.0}}:{{VAULTWARDEN_PORT:-8800}}:80"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: "{{VAULTWARDEN_MEM_LIMIT:-256m}}"
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-file: "{{DOCKERLOGGING_MAXFILE}}"
|
|
max-size: "{{DOCKERLOGGING_MAXSIZE}}"
|
|
|
|
volumes:
|
|
vaultwarden_data:
|