set up stalwart as oidc provider

.env.example

@@ -1,14 +1,16 @@
 # stalwart
 STALWART_PUBLIC_URL=https://m.example.org
+OIDC_KEY=GENERATE_STRING # openssl rand -hex 32
+OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve
 
 # bulwark
 JMAP_SERVER_URL=https://m.example.org
-SESSION_SECRET=very_long_string
+SESSION_SECRET=GENERATE_STRING # openssl rand -hex 32
 SETTINGS_SYNC_ENABLED=true
-ADMIN_PASSWORD=password
+ADMIN_PASSWORD=GENERATE_PASSWORD # tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo
 
 # vykar
 VYKAR_LABEL=borgbase
 VYKAR_URL=https://myrepo.repo.borgbase.com
-VYKAR_ACCESS_TOKEN=access_token
-VYKAR_ENCRYPTION_SECRET=very_long_string
+VYKAR_ACCESS_TOKEN=ACCESS_TOKEN
+VYKAR_ENCRYPTION_SECRET=GENERATE_STRING # openssl rand -hex 32

README.md

@@ -69,6 +69,14 @@ specifics for everything
   - added `172.18.0.0/24`; reason: `internal`
 - settings -> network -> http -> security
   - permissive cors policy: `true`   **[restart needed]**
+- settings -> authentication -> oidc provider
+  - oauth settings
+    - key: `secret read from environment variable`
+    - variable name: `OIDC_KEY`
+  - openid connect
+    - signature algorithm: `ECDSA using P-384 and SHA-384`
+    - signature key: `secret read from environment variable`
+    - variable name: `OIDC_SIGNATURE_KEY`
 
 **useful links**
 

docker-compose.yml

@@ -26,6 +26,8 @@ services:
       - "127.0.0.1:8080:8080"
     environment:
       - STALWART_PUBLIC_URL
+      - OIDC_KEY
+      - OIDC_SIGNATURE_KEY
     volumes:
       - stalwart-etc:/etc/stalwart
       - stalwart-data:/var/lib/stalwart