From c9c1489abb25610553772184d8b0ddd5d575377c Mon Sep 17 00:00:00 2001 From: Bryan Brooks Date: Tue, 24 Feb 2026 13:31:01 -0600 Subject: [PATCH] feat: add 10 OIDC app presets to setup wizard Paperless-ngx, Vaultwarden, Miniflux, Mattermost, Vikunja, Plane, GoToSocial, Stirling-PDF, Tandoor Recipes, FreshRSS. Brings total wizard presets from 10 to 20. Each includes verified redirect URI, PKCE/auth method settings, and step-by-step setup instructions from official documentation. Co-Authored-By: Claude Opus 4.6 --- gateway/src/data/oidc-presets.ts | 150 +++++++++++++++++++++++++++++++ 1 file changed, 150 insertions(+) diff --git a/gateway/src/data/oidc-presets.ts b/gateway/src/data/oidc-presets.ts index 61861fc..d83228f 100644 --- a/gateway/src/data/oidc-presets.ts +++ b/gateway/src/data/oidc-presets.ts @@ -183,6 +183,156 @@ export const OIDC_APP_PRESETS: OIDCAppPreset[] = [ refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n OIDC_AUTH_ENABLED=true\n OIDC_CLIENT_ID=mealie\n OIDC_CLIENT_SECRET=\n OIDC_CONFIGURATION_URL=/.well-known/openid-configuration\n OIDC_SIGNUP_ENABLED=true\n OIDC_PROVIDER_NAME=ATAuth', }, + { + key: 'paperless-ngx', + name: 'Paperless-ngx', + description: 'Document management system', + suggested_client_id: 'paperless', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/accounts/oidc/atauth/login/callback/', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: true, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n PAPERLESS_APPS=allauth.socialaccount.providers.openid_connect\n PAPERLESS_SOCIALACCOUNT_PROVIDERS=\'{"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"atauth","name":"ATAuth","client_id":"","secret":"","settings":{"server_url":"","token_auth_method":"client_secret_basic"}}]}}\'\nOptional:\n PAPERLESS_SOCIAL_AUTO_SIGNUP=true\n PAPERLESS_REDIRECT_LOGIN_TO_SSO=true\nRequires Paperless-ngx v2.5.0+.', + }, + { + key: 'vaultwarden', + name: 'Vaultwarden', + description: 'Bitwarden-compatible password manager', + suggested_client_id: 'vaultwarden', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/identity/connect/oidc-signin', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: true, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n SSO_ENABLED=true\n SSO_AUTHORITY= (no trailing slash, no .well-known)\n SSO_CLIENT_ID=vaultwarden\n SSO_CLIENT_SECRET=\nOptional:\n SSO_ONLY=true (disable password login)\nNote: Master password is still required even with SSO enabled.', + }, + { + key: 'miniflux', + name: 'Miniflux', + description: 'Minimalist RSS reader', + suggested_client_id: 'miniflux', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/oauth2/oidc/callback', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: true, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n OAUTH2_PROVIDER=oidc\n OAUTH2_CLIENT_ID=miniflux\n OAUTH2_CLIENT_SECRET=\n OAUTH2_REDIRECT_URL=https://your-domain/oauth2/oidc/callback\n OAUTH2_OIDC_DISCOVERY_ENDPOINT= (no .well-known suffix)\n OAUTH2_OIDC_PROVIDER_NAME=ATAuth\n OAUTH2_USER_CREATION=1', + }, + { + key: 'mattermost', + name: 'Mattermost', + description: 'Team messaging platform', + suggested_client_id: 'mattermost', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/signup/openid/complete', + token_endpoint_auth_method: 'client_secret_post', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'In System Console > Authentication > OpenID Connect:\n1. Select "OpenID Connect (Other)"\n2. Discovery Endpoint: /.well-known/openid-configuration\n3. Client ID and Client Secret from above\n4. Button Name: ATAuth\nRequires Mattermost Enterprise, Professional, or Entry edition.\nTeam Edition: Use GitLab SSO path instead (/signup/gitlab/complete) with GitLabSettings in config.json.', + }, + { + key: 'vikunja', + name: 'Vikunja', + description: 'Task and project management', + suggested_client_id: 'vikunja', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/auth/openid/atauth', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n VIKUNJA_AUTH_OPENID_ENABLED=true\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_NAME=ATAuth\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_AUTHURL=\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_CLIENTID=vikunja\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_CLIENTSECRET=\nOr in config.yml under auth.openid.providers.atauth.', + }, + { + key: 'plane', + name: 'Plane', + description: 'Project management and issue tracking', + suggested_client_id: 'plane', + grant_types: ['authorization_code'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/auth/oidc/callback/', + token_endpoint_auth_method: 'client_secret_post', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'In God Mode (/god-mode/authentication/oidc/):\n1. Client ID and Client Secret from above\n2. Authorize URL: /oauth/authorize\n3. Token URL: /oauth/token\n4. User Info URL: /oauth/userinfo\nNote: Plane does not support OIDC Discovery -- you must enter each endpoint URL manually. Trailing slashes on redirect URIs are required.', + }, + { + key: 'gotosocial', + name: 'GoToSocial', + description: 'Lightweight fediverse server', + suggested_client_id: 'gotosocial', + grant_types: ['authorization_code'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/auth/callback', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'In config.yaml:\n oidc-enabled: true\n oidc-idp-name: ATAuth\n oidc-issuer: \n oidc-client-id: gotosocial\n oidc-client-secret: \n oidc-scopes:\n - openid\n - email\n - profile', + }, + { + key: 'stirling-pdf', + name: 'Stirling-PDF', + description: 'PDF manipulation toolkit', + suggested_client_id: 'stirling-pdf', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/login/oauth2/code/atauth', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n SECURITY_ENABLELOGIN=true\n SECURITY_OAUTH2_ENABLED=true\n SECURITY_OAUTH2_ISSUER= (no .well-known suffix)\n SECURITY_OAUTH2_CLIENTID=stirling-pdf\n SECURITY_OAUTH2_CLIENTSECRET=\n SECURITY_OAUTH2_PROVIDER=atauth\n SECURITY_OAUTH2_SCOPES=openid, profile, email\n SECURITY_OAUTH2_USEASUSERNAME=preferred_username', + }, + { + key: 'tandoor', + name: 'Tandoor Recipes', + description: 'Recipe management and meal planning', + suggested_client_id: 'tandoor', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/accounts/oidc/atauth/login/callback/', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: true, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect\n SOCIALACCOUNT_PROVIDERS=\'{"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"atauth","name":"ATAuth","client_id":"","secret":"","settings":{"server_url":"/.well-known/openid-configuration"}}]}}\'\nUses the same django-allauth pattern as Paperless-ngx.', + }, + { + key: 'freshrss', + name: 'FreshRSS', + description: 'RSS feed aggregator', + suggested_client_id: 'freshrss', + grant_types: ['authorization_code', 'refresh_token'], + scopes: ['openid', 'profile', 'email'], + redirect_uri_template: 'https://{{DOMAIN}}/i/oidc/', + token_endpoint_auth_method: 'client_secret_basic', + require_pkce: false, + id_token_ttl_seconds: 3600, + access_token_ttl_seconds: 3600, + refresh_token_ttl_seconds: 604800, + setup_notes: 'Set these environment variables:\n OIDC_ENABLED=1\n OIDC_PROVIDER_METADATA_URL=/.well-known/openid-configuration\n OIDC_CLIENT_ID=freshrss\n OIDC_CLIENT_SECRET=\n OIDC_CLIENT_CRYPTO_KEY= (session encryption key)\n OIDC_REMOTE_USER_CLAIM=preferred_username\n OIDC_SCOPES=openid email profile\nBehind reverse proxy, add:\n OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto\nNote: Select "HTTP Authentication" during initial FreshRSS setup. Create the default user with the same username as your OIDC identity.', + }, ]; export function getPresetByKey(key: string): OIDCAppPreset | undefined { -- knotmirror 0.0.1