From 4443926ca4c82f082938a26ab06019686150544b Mon Sep 17 00:00:00 2001 From: futile Date: Sun, 19 Jul 2026 03:52:57 +0100 Subject: [PATCH] set up stalwart as oidc provider --- .env.example | 10 ++++++---- README.md | 8 ++++++++ docker-compose.yml | 2 ++ 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/.env.example b/.env.example index 3b3ba37..86b60fd 100644 --- a/.env.example +++ b/.env.example @@ -1,14 +1,16 @@ # stalwart STALWART_PUBLIC_URL=https://m.example.org +OIDC_KEY=GENERATE_STRING # openssl rand -hex 32 +OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve # bulwark JMAP_SERVER_URL=https://m.example.org -SESSION_SECRET=very_long_string +SESSION_SECRET=GENERATE_STRING # openssl rand -hex 32 SETTINGS_SYNC_ENABLED=true -ADMIN_PASSWORD=password +ADMIN_PASSWORD=GENERATE_PASSWORD # tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo # vykar VYKAR_LABEL=borgbase VYKAR_URL=https://myrepo.repo.borgbase.com -VYKAR_ACCESS_TOKEN=access_token -VYKAR_ENCRYPTION_SECRET=very_long_string +VYKAR_ACCESS_TOKEN=ACCESS_TOKEN +VYKAR_ENCRYPTION_SECRET=GENERATE_STRING # openssl rand -hex 32 diff --git a/README.md b/README.md index 4e45228..e5690c4 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,14 @@ specifics for everything - added `172.18.0.0/24`; reason: `internal` - settings -> network -> http -> security - permissive cors policy: `true` **[restart needed]** +- settings -> authentication -> oidc provider + - oauth settings + - key: `secret read from environment variable` + - variable name: `OIDC_KEY` + - openid connect + - signature algorithm: `ECDSA using P-384 and SHA-384` + - signature key: `secret read from environment variable` + - variable name: `OIDC_SIGNATURE_KEY` **useful links** diff --git a/docker-compose.yml b/docker-compose.yml index 739c5f9..4dc7fbc 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -26,6 +26,8 @@ services: - "127.0.0.1:8080:8080" environment: - STALWART_PUBLIC_URL + - OIDC_KEY + - OIDC_SIGNATURE_KEY volumes: - stalwart-etc:/etc/stalwart - stalwart-data:/var/lib/stalwart