da5652aa10
- Add SSO environment variables to template.yaml (SSO_ENABLED, SSO_ONLY,
SSO_AUTHORITY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_SCOPES, SSO_PKCE,
SSO_AUDIENCE_TRUSTED)
- Add SSO variables to .env.sample with Zitadel audience quirk explained
- Document full Zitadel setup in README: app creation, redirect URI, OIDC
settings, and the audience fix (SSO_AUDIENCE_TRUSTED=^\d{18}$)
- Update .gitignore to track .env.sample files in docker-compose-files
36 lines
1.3 KiB
Text
36 lines
1.3 KiB
Text
# Vaultwarden
|
|
VAULTWARDEN_VERSION=latest
|
|
# Full URL where Vaultwarden is reachable (used for FIDO2/WebAuthn and email links)
|
|
VAULTWARDEN_DOMAIN=https://vaultwarden.home.example.com
|
|
VAULTWARDEN_SIGNUPS_ALLOWED=false
|
|
# Generate with: docker run --rm -it vaultwarden/server /vaultwarden hash
|
|
VAULTWARDEN_ADMIN_TOKEN=
|
|
VAULTWARDEN_PORT=8800
|
|
VAULTWARDEN_BIND_IP=0.0.0.0
|
|
VAULTWARDEN_MEM_LIMIT=256m
|
|
|
|
# Mobile push notifications (optional — register at https://bitwarden.com/host/)
|
|
VAULTWARDEN_PUSH_ENABLED=false
|
|
VAULTWARDEN_PUSH_ID=
|
|
VAULTWARDEN_PUSH_KEY=
|
|
|
|
# SSO via OIDC (optional — set SSO_AUTHORITY to enable)
|
|
# See README for Zitadel setup instructions
|
|
VAULTWARDEN_SSO_ENABLED=false
|
|
VAULTWARDEN_SSO_ONLY=false
|
|
VAULTWARDEN_SSO_AUTHORITY=
|
|
VAULTWARDEN_SSO_CLIENT_ID=
|
|
VAULTWARDEN_SSO_CLIENT_SECRET=
|
|
VAULTWARDEN_SSO_SCOPES=openid email profile offline_access
|
|
VAULTWARDEN_SSO_PKCE=true
|
|
# Zitadel includes all project app client IDs in aud; trust any 18-digit Zitadel ID.
|
|
# Adjust the digit count if your Zitadel instance uses a different ID length.
|
|
VAULTWARDEN_SSO_AUDIENCE_TRUSTED=^\d{18}$
|
|
|
|
# SMTP settings (shared with other stacks — leave blank to disable email)
|
|
EMAIL_HOST=
|
|
EMAIL_PORT=587
|
|
EMAIL_HOST_USER=
|
|
EMAIL_HOST_PASSWORD=
|
|
VAULTWARDEN_SMTP_FROM=
|
|
VAULTWARDEN_SMTP_SECURITY=starttls
|