lhahnandClaude Opus 5.5
0417ecd9a1
- SSO_* settings (login only, master password still decrypts the vault) - optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts - blueprints are copied into the authentik container, it only applies files from /blueprints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
---
|
|
cloud_apps: /opt
|
|
cloud_storage: /opt/storage
|
|
cloud_stage: prod
|
|
cloud_update: false
|
|
domain_external: "my-domain.tld"
|
|
|
|
|
|
vaultwarden_version: 1.37.4
|
|
vaultwarden_image: ghcr.io/dani-garcia/vaultwarden
|
|
|
|
vaultwarden_domain: "vault.{{ domain_external }}"
|
|
vaultwarden_http_port: 8222
|
|
vaultwarden_data_location: "{{ cloud_storage }}/vaultwarden-data"
|
|
|
|
vaultwarden_signups_allowed: false
|
|
#comma separated domains that may sign up even with sign ups disabled
|
|
vaultwarden_signups_domains_whitelist: ""
|
|
vaultwarden_signups_verify: true
|
|
vaultwarden_invitations_allowed: true
|
|
vaultwarden_invitation_org_name: "Vaultwarden"
|
|
vaultwarden_show_password_hint: false
|
|
vaultwarden_password_iterations: 600000
|
|
|
|
#argon2 PHC string (vaultwarden hash); empty disables the admin panel
|
|
vaultwarden_admin_token:
|
|
|
|
vaultwarden_smtp_host: "mail.{{ domain_external }}"
|
|
vaultwarden_smtp_port: 465
|
|
vaultwarden_smtp_security: force_tls
|
|
vaultwarden_smtp_from: "noreply@{{ domain_external }}"
|
|
vaultwarden_smtp_from_name: Vaultwarden
|
|
vaultwarden_smtp_user: user@my-domain.tld
|
|
vaultwarden_smtp_pass: ThisCouldBeYourAdd
|
|
|
|
vaultwarden_loglevel: warn
|
|
|
|
#OpenID Connect single sign on (login only; the master password still decrypts the vault)
|
|
vaultwarden_sso_enabled: false
|
|
vaultwarden_sso_only: false
|
|
vaultwarden_sso_signups_match_email: true
|
|
vaultwarden_sso_authority: "https://idp.{{ domain_external }}/application/o/{{ vaultwarden_sso_slug }}/"
|
|
vaultwarden_sso_scopes: "email profile offline_access"
|
|
vaultwarden_sso_client_id: vaultwarden
|
|
vaultwarden_sso_client_secret: SSOClientSecret
|
|
|
|
#create provider + application in a local authentik through a blueprint
|
|
vaultwarden_sso_authentik: false
|
|
vaultwarden_sso_slug: vaultwarden
|
|
vaultwarden_sso_name: Vaultwarden
|
|
vaultwarden_sso_authentik_data: "{{ cloud_apps }}/authentik/inst/data"
|
|
vaultwarden_sso_authentik_container: inst-worker-1
|
|
vaultwarden_sso_authentik_signing_key: "authentik Self-signed Certificate"
|
|
vaultwarden_sso_authentik_authorization_flow: default-provider-authorization-implicit-consent
|
|
vaultwarden_sso_authentik_invalidation_flow: default-provider-invalidation-flow
|