diff --git a/README.md b/README.md
index 2acd872..6441550 100755
--- a/README.md
+++ b/README.md
@@ -19,11 +19,11 @@ phone-home, no hosted control plane, and no per-user pricing.
| Dashboard | Users |
| --- | --- |
-|  |  |
+| [](docs/images/dashboard.png) | [](docs/images/users.png) |
| Groups | OAuth Apps |
| --- | --- |
-|  |  |
+| [](docs/images/groups.png) | [](docs/images/oauth-clients.png) |
## Features
diff --git a/docs/_config.yml b/docs/_config.yml
index 2e83116..b08b1e9 100644
--- a/docs/_config.yml
+++ b/docs/_config.yml
@@ -1,7 +1,7 @@
title: SSO Manager
description: A self-hosted OpenID Connect provider with an OpenLDAP directory and a web management UI
theme: jekyll-theme-cayman
-show_downloads: true
+show_downloads: false
github:
repository_url: https://github.com/theta42/sso-manager-node
zip_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.zip
diff --git a/docs/index.md b/docs/index.md
index 1ec85e9..f4597a8 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -9,33 +9,54 @@ A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory**
and a web management UI — for home labs and small businesses that want their
own identity provider instead of a hosted one.
+One place to manage your users and groups, one login (OIDC) your modern apps
+can use, and one LDAP directory your older or odder apps can bind to directly.
+Everything runs on your own hardware; no phone-home, no hosted control plane,
+no per-user pricing.
+
+Part of the theta42 self-hosted identity stack, alongside
+[Proxy](https://theta42.github.io/proxy/) (an OIDC + LDAP-aware reverse proxy)
+and [theta-env](https://theta42.github.io/theta-env/) (the two composed with
+one command).
+
## Screenshots
-| Dashboard | Users |
-| --- | --- |
-|  |  |
+
+
+
+
-| Groups | OAuth Apps |
-| --- | --- |
-|  |  |
+*(click any screenshot to view full size)*
+
+## Why this over the alternatives
+
+Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but
+LDAP is either a paid feature, a federation target you have to run
+separately, or absent. If your stack already has apps that speak LDAP
+directly — or you just want one real directory as the source of truth — you
+end up running *two* identity systems and keeping them in sync.
+
+SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC
+apps and LDAP apps read from the same users and groups. The trade-off is
+scope: it's intentionally small and self-hosted, not an enterprise IAM suite.
+If you want a lightweight, self-contained identity provider with a real LDAP
+backend, that's the niche.
## Features
-- **OpenID Connect / OAuth 2.0 provider** — issue your own access/refresh/id
- tokens; protect your apps with OIDC login.
-- **OpenLDAP directory** — users, groups, POSIX accounts (`posixAccount`/
- `inetOrgPerson`), SSH public keys, and sudo roles, with `memberOf` +
- referential-integrity overlays.
-- **Web management UI** — manage users, groups, and OAuth clients from a
- browser; invite/password-reset flows over email.
-- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, …)
- can use LDAPS (636) / StartTLS.
+- **OpenID Connect / OAuth 2.0 provider** — your own access/refresh/ID
+ tokens; standard discovery document at `/.well-known/openid-configuration`.
+- **Bundled OpenLDAP directory** — users, groups, POSIX accounts, SSH public
+ keys, and sudo roles, with `memberOf` + referential-integrity overlays.
+- **Web management UI** — users, groups, and OAuth clients from a browser;
+ invite and password-reset flows over email; self-service profile + API
+ tokens.
+- **LDAPS for legacy apps** — anything that binds LDAP directly (Gitea,
+ Emby, …) uses LDAPS/StartTLS against the same directory.
- **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
- run each piece separately via `app_*` env config.
+ run the pieces separately via `app_*` env config.
-## Quick Start
-
-### Docker (all-in-one)
+## Get it
```bash
git clone https://github.com/theta42/sso-manager-node.git
@@ -44,72 +65,14 @@ cp secrets.js.example nodejs/conf/secrets.js # edit it, or use app_* env
docker compose up -d --build
```
-The web UI comes up at `http://localhost:3001`. See the
-[Deployment Guide](deployment.html) for the full set of `app_*` env vars.
+That's the standalone quick start. For the full set of install options
+(Docker, bare-metal, or as part of the combined SSO + proxy stack), the
+`app_*` env reference, and the OAuth/LDAP internals, see the
+**[GitHub repository](https://github.com/theta42/sso-manager-node)**.
-### Bare metal (Debian/Ubuntu)
+## Related projects
-```bash
-sudo ./install.sh
-```
-
-Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app,
-and starts a systemd unit. Re-run to update.
-
-### Run it together with the proxy
-
-The proxy ([theta42/proxy](https://github.com/theta42/proxy)) fronts this SSO
-under TLS and protects it with OIDC, while also binding LDAP directly. Run both
-with one command via [theta-env](https://github.com/theta42/theta-env):
-
-```bash
-git clone --recursive https://github.com/theta42/theta-env.git
-cd theta-env && cp setup.env.example setup.env # set CFG_DOMAIN to your domain, then:
-./setup.sh
-```
-
-## Documentation
-
-- [Deployment Guide](deployment.html) — Docker + bare metal, the config layers,
- the `app_*` env reference, backups.
-- [Configuration](configuration.html) — every `app_*` env var and the conf
- merge order.
-- [OAuth / OIDC](oauth.html) — the provider: discovery, client management,
- token lifetimes, scopes.
-- [LDAP](ldap.html) — directory layout, TLS, overlays, schema, direct-bind
- service accounts.
-
-## Architecture
-
-```
-┌─────────────┐
-│ Browser / │
-│ OIDC apps │
-└──────┬──────┘
- │ HTTP/HTTPS
- ▼
-┌────────────────────────┐ ┌─────────────┐
-│ Express SSO Manager │◄────►│ Redis │
-│ - OIDC provider │ │ - sessions │
-│ - web UI (:3001) │ │ - models │
-│ - management API │ └─────────────┘
-└────────┬───────────────┘
- │ ldapi/ldap (localhost)
- ▼
-┌────────────────────────┐
-│ OpenLDAP (slapd) │
-│ - users / groups │
-│ - LDAPS :636 │─── legacy apps bind directly
-│ - StartTLS :389 │
-└────────────────────────┘
-```
-
-## Community
-
-- [GitHub Repository](https://github.com/theta42/sso-manager-node)
-- [Issue Tracker](https://github.com/theta42/sso-manager-node/issues)
-- [Pull Requests](https://github.com/theta42/sso-manager-node/pulls)
-
-## License
-
-MIT License — see the repository for details.
\ No newline at end of file
+- **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware
+ reverse proxy, designed to sit in front of this SSO.
+- **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO
+ Manager and the proxy together with one command.