From 60e1f5b2042125483b5655deb4286c5f2616a143 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Wed, 15 Jul 2026 16:08:28 -0400 Subject: [PATCH] Turn GitHub Pages into a marketing landing page; cross-link, drop download buttons MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Rewrite docs/index.md as a short landing page (what it is, screenshots, why this over the alternatives, features, a minimal "get it" snippet) instead of a full documentation dump — full docs live in the repo (README, docs/*.md) and are linked from here. - Cross-link to Proxy and theta-env's own Pages sites. - Screenshots are now clickable (open full size) on both the Pages site and the README. - Disable show_downloads in docs/_config.yml — the Cayman theme's "Download .zip/.tar.gz" buttons are gone; "View on GitHub" (which links back to the repo) is the only header link now. Co-Authored-By: Claude Sonnet 5 --- README.md | 4 +- docs/_config.yml | 2 +- docs/index.md | 135 +++++++++++++++++------------------------------ 3 files changed, 52 insertions(+), 89 deletions(-) diff --git a/README.md b/README.md index 2acd872..6441550 100755 --- a/README.md +++ b/README.md @@ -19,11 +19,11 @@ phone-home, no hosted control plane, and no per-user pricing. | Dashboard | Users | | --- | --- | -| ![Dashboard](docs/images/dashboard.png) | ![User list](docs/images/users.png) | +| [![Dashboard](docs/images/dashboard.png)](docs/images/dashboard.png) | [![User list](docs/images/users.png)](docs/images/users.png) | | Groups | OAuth Apps | | --- | --- | -| ![Groups](docs/images/groups.png) | ![OAuth clients](docs/images/oauth-clients.png) | +| [![Groups](docs/images/groups.png)](docs/images/groups.png) | [![OAuth clients](docs/images/oauth-clients.png)](docs/images/oauth-clients.png) | ## Features diff --git a/docs/_config.yml b/docs/_config.yml index 2e83116..b08b1e9 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1,7 +1,7 @@ title: SSO Manager description: A self-hosted OpenID Connect provider with an OpenLDAP directory and a web management UI theme: jekyll-theme-cayman -show_downloads: true +show_downloads: false github: repository_url: https://github.com/theta42/sso-manager-node zip_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.zip diff --git a/docs/index.md b/docs/index.md index 1ec85e9..f4597a8 100644 --- a/docs/index.md +++ b/docs/index.md @@ -9,33 +9,54 @@ A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory** and a web management UI — for home labs and small businesses that want their own identity provider instead of a hosted one. +One place to manage your users and groups, one login (OIDC) your modern apps +can use, and one LDAP directory your older or odder apps can bind to directly. +Everything runs on your own hardware; no phone-home, no hosted control plane, +no per-user pricing. + +Part of the theta42 self-hosted identity stack, alongside +[Proxy](https://theta42.github.io/proxy/) (an OIDC + LDAP-aware reverse proxy) +and [theta-env](https://theta42.github.io/theta-env/) (the two composed with +one command). + ## Screenshots -| Dashboard | Users | -| --- | --- | -| ![Dashboard](images/dashboard.png) | ![User list](images/users.png) | +Dashboard +User list +Groups +OAuth clients -| Groups | OAuth Apps | -| --- | --- | -| ![Groups](images/groups.png) | ![OAuth clients](images/oauth-clients.png) | +*(click any screenshot to view full size)* + +## Why this over the alternatives + +Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but +LDAP is either a paid feature, a federation target you have to run +separately, or absent. If your stack already has apps that speak LDAP +directly — or you just want one real directory as the source of truth — you +end up running *two* identity systems and keeping them in sync. + +SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC +apps and LDAP apps read from the same users and groups. The trade-off is +scope: it's intentionally small and self-hosted, not an enterprise IAM suite. +If you want a lightweight, self-contained identity provider with a real LDAP +backend, that's the niche. ## Features -- **OpenID Connect / OAuth 2.0 provider** — issue your own access/refresh/id - tokens; protect your apps with OIDC login. -- **OpenLDAP directory** — users, groups, POSIX accounts (`posixAccount`/ - `inetOrgPerson`), SSH public keys, and sudo roles, with `memberOf` + - referential-integrity overlays. -- **Web management UI** — manage users, groups, and OAuth clients from a - browser; invite/password-reset flows over email. -- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, …) - can use LDAPS (636) / StartTLS. +- **OpenID Connect / OAuth 2.0 provider** — your own access/refresh/ID + tokens; standard discovery document at `/.well-known/openid-configuration`. +- **Bundled OpenLDAP directory** — users, groups, POSIX accounts, SSH public + keys, and sudo roles, with `memberOf` + referential-integrity overlays. +- **Web management UI** — users, groups, and OAuth clients from a browser; + invite and password-reset flows over email; self-service profile + API + tokens. +- **LDAPS for legacy apps** — anything that binds LDAP directly (Gitea, + Emby, …) uses LDAPS/StartTLS against the same directory. - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or - run each piece separately via `app_*` env config. + run the pieces separately via `app_*` env config. -## Quick Start - -### Docker (all-in-one) +## Get it ```bash git clone https://github.com/theta42/sso-manager-node.git @@ -44,72 +65,14 @@ cp secrets.js.example nodejs/conf/secrets.js # edit it, or use app_* env docker compose up -d --build ``` -The web UI comes up at `http://localhost:3001`. See the -[Deployment Guide](deployment.html) for the full set of `app_*` env vars. +That's the standalone quick start. For the full set of install options +(Docker, bare-metal, or as part of the combined SSO + proxy stack), the +`app_*` env reference, and the OAuth/LDAP internals, see the +**[GitHub repository](https://github.com/theta42/sso-manager-node)**. -### Bare metal (Debian/Ubuntu) +## Related projects -```bash -sudo ./install.sh -``` - -Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app, -and starts a systemd unit. Re-run to update. - -### Run it together with the proxy - -The proxy ([theta42/proxy](https://github.com/theta42/proxy)) fronts this SSO -under TLS and protects it with OIDC, while also binding LDAP directly. Run both -with one command via [theta-env](https://github.com/theta42/theta-env): - -```bash -git clone --recursive https://github.com/theta42/theta-env.git -cd theta-env && cp setup.env.example setup.env # set CFG_DOMAIN to your domain, then: -./setup.sh -``` - -## Documentation - -- [Deployment Guide](deployment.html) — Docker + bare metal, the config layers, - the `app_*` env reference, backups. -- [Configuration](configuration.html) — every `app_*` env var and the conf - merge order. -- [OAuth / OIDC](oauth.html) — the provider: discovery, client management, - token lifetimes, scopes. -- [LDAP](ldap.html) — directory layout, TLS, overlays, schema, direct-bind - service accounts. - -## Architecture - -``` -┌─────────────┐ -│ Browser / │ -│ OIDC apps │ -└──────┬──────┘ - │ HTTP/HTTPS - ▼ -┌────────────────────────┐ ┌─────────────┐ -│ Express SSO Manager │◄────►│ Redis │ -│ - OIDC provider │ │ - sessions │ -│ - web UI (:3001) │ │ - models │ -│ - management API │ └─────────────┘ -└────────┬───────────────┘ - │ ldapi/ldap (localhost) - ▼ -┌────────────────────────┐ -│ OpenLDAP (slapd) │ -│ - users / groups │ -│ - LDAPS :636 │─── legacy apps bind directly -│ - StartTLS :389 │ -└────────────────────────┘ -``` - -## Community - -- [GitHub Repository](https://github.com/theta42/sso-manager-node) -- [Issue Tracker](https://github.com/theta42/sso-manager-node/issues) -- [Pull Requests](https://github.com/theta42/sso-manager-node/pulls) - -## License - -MIT License — see the repository for details. \ No newline at end of file +- **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware + reverse proxy, designed to sit in front of this SSO. +- **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO + Manager and the proxy together with one command.