Merge pull request #50 from theta42/marketing-pages

Turn GitHub Pages into a marketing landing page

README.md

@@ -19,11 +19,11 @@ phone-home, no hosted control plane, and no per-user pricing.
 
 | Dashboard | Users |
 | --- | --- |
-| ![Dashboard](docs/images/dashboard.png) | ![User list](docs/images/users.png) |
+| [![Dashboard](docs/images/dashboard.png)](docs/images/dashboard.png) | [![User list](docs/images/users.png)](docs/images/users.png) |
 
 | Groups | OAuth Apps |
 | --- | --- |
-| ![Groups](docs/images/groups.png) | ![OAuth clients](docs/images/oauth-clients.png) |
+| [![Groups](docs/images/groups.png)](docs/images/groups.png) | [![OAuth clients](docs/images/oauth-clients.png)](docs/images/oauth-clients.png) |
 
 ## Features
 

docs/_config.yml

@@ -1,7 +1,7 @@
 title: SSO Manager
 description: A self-hosted OpenID Connect provider with an OpenLDAP directory and a web management UI
 theme: jekyll-theme-cayman
-show_downloads: true
+show_downloads: false
 github:
   repository_url: https://github.com/theta42/sso-manager-node
   zip_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.zip

docs/index.md

@@ -9,33 +9,54 @@ A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory**
 and a web management UI — for home labs and small businesses that want their
 own identity provider instead of a hosted one.
 
+One place to manage your users and groups, one login (OIDC) your modern apps
+can use, and one LDAP directory your older or odder apps can bind to directly.
+Everything runs on your own hardware; no phone-home, no hosted control plane,
+no per-user pricing.
+
+Part of the theta42 self-hosted identity stack, alongside
+[Proxy](https://theta42.github.io/proxy/) (an OIDC + LDAP-aware reverse proxy)
+and [theta-env](https://theta42.github.io/theta-env/) (the two composed with
+one command).
+
 ## Screenshots
 
-| Dashboard | Users |
+<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
-| --- | --- |
+<a href="images/users.png" target="_blank"><img src="images/users.png" alt="User list" width="49%"></a>
-| ![Dashboard](images/dashboard.png) | ![User list](images/users.png) |
+<a href="images/groups.png" target="_blank"><img src="images/groups.png" alt="Groups" width="49%"></a>
+<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="OAuth clients" width="49%"></a>
 
-| Groups | OAuth Apps |
+*(click any screenshot to view full size)*
-| --- | --- |
+
-| ![Groups](images/groups.png) | ![OAuth clients](images/oauth-clients.png) |
+## Why this over the alternatives
+
+Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but
+LDAP is either a paid feature, a federation target you have to run
+separately, or absent. If your stack already has apps that speak LDAP
+directly — or you just want one real directory as the source of truth — you
+end up running *two* identity systems and keeping them in sync.
+
+SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC
+apps and LDAP apps read from the same users and groups. The trade-off is
+scope: it's intentionally small and self-hosted, not an enterprise IAM suite.
+If you want a lightweight, self-contained identity provider with a real LDAP
+backend, that's the niche.
 
 ## Features
 
-- **OpenID Connect / OAuth 2.0 provider** — issue your own access/refresh/id
+- **OpenID Connect / OAuth 2.0 provider** — your own access/refresh/ID
-  tokens; protect your apps with OIDC login.
+  tokens; standard discovery document at `/.well-known/openid-configuration`.
-- **OpenLDAP directory** — users, groups, POSIX accounts (`posixAccount`/
+- **Bundled OpenLDAP directory** — users, groups, POSIX accounts, SSH public
-  `inetOrgPerson`), SSH public keys, and sudo roles, with `memberOf` +
+  keys, and sudo roles, with `memberOf` + referential-integrity overlays.
-  referential-integrity overlays.
+- **Web management UI** — users, groups, and OAuth clients from a browser;
-- **Web management UI** — manage users, groups, and OAuth clients from a
+  invite and password-reset flows over email; self-service profile + API
-  browser; invite/password-reset flows over email.
+  tokens.
-- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, …)
+- **LDAPS for legacy apps** — anything that binds LDAP directly (Gitea,
-  can use LDAPS (636) / StartTLS.
+  Emby, …) uses LDAPS/StartTLS against the same directory.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
-  run each piece separately via `app_*` env config.
+  run the pieces separately via `app_*` env config.
 
-## Quick Start
+## Get it
-
-### Docker (all-in-one)
 
 ```bash
 git clone https://github.com/theta42/sso-manager-node.git
@@ -44,72 +65,14 @@ cp secrets.js.example nodejs/conf/secrets.js   # edit it, or use app_* env
 docker compose up -d --build
 ```
 
-The web UI comes up at `http://localhost:3001`. See the
+That's the standalone quick start. For the full set of install options
-[Deployment Guide](deployment.html) for the full set of `app_*` env vars.
+(Docker, bare-metal, or as part of the combined SSO + proxy stack), the
+`app_*` env reference, and the OAuth/LDAP internals, see the
+**[GitHub repository](https://github.com/theta42/sso-manager-node)**.
 
-### Bare metal (Debian/Ubuntu)
+## Related projects
 
-```bash
+- **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware
-sudo ./install.sh
+  reverse proxy, designed to sit in front of this SSO.
-```
+- **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO
-
+  Manager and the proxy together with one command.
-Idempotent installer — installs Node.js, OpenLDAP, Redis, configures the app,
-and starts a systemd unit. Re-run to update.
-
-### Run it together with the proxy
-
-The proxy ([theta42/proxy](https://github.com/theta42/proxy)) fronts this SSO
-under TLS and protects it with OIDC, while also binding LDAP directly. Run both
-with one command via [theta-env](https://github.com/theta42/theta-env):
-
-```bash
-git clone --recursive https://github.com/theta42/theta-env.git
-cd theta-env && cp setup.env.example setup.env   # set CFG_DOMAIN to your domain, then:
-./setup.sh
-```
-
-## Documentation
-
-- [Deployment Guide](deployment.html) — Docker + bare metal, the config layers,
-  the `app_*` env reference, backups.
-- [Configuration](configuration.html) — every `app_*` env var and the conf
-  merge order.
-- [OAuth / OIDC](oauth.html) — the provider: discovery, client management,
-  token lifetimes, scopes.
-- [LDAP](ldap.html) — directory layout, TLS, overlays, schema, direct-bind
-  service accounts.
-
-## Architecture
-
-```
-┌─────────────┐
-│  Browser /  │
-│  OIDC apps  │
-└──────┬──────┘
-       │ HTTP/HTTPS
-       ▼
-┌────────────────────────┐      ┌─────────────┐
-│  Express SSO Manager   │◄────►│   Redis     │
-│  - OIDC provider       │      │ - sessions  │
-│  - web UI (:3001)      │      │ - models    │
-│  - management API      │      └─────────────┘
-└────────┬───────────────┘
-         │ ldapi/ldap (localhost)
-         ▼
-┌────────────────────────┐
-│  OpenLDAP (slapd)      │
-│  - users / groups      │
-│  - LDAPS :636          │─── legacy apps bind directly
-│  - StartTLS :389       │
-└────────────────────────┘
-```
-
-## Community
-
-- [GitHub Repository](https://github.com/theta42/sso-manager-node)
-- [Issue Tracker](https://github.com/theta42/sso-manager-node/issues)
-- [Pull Requests](https://github.com/theta42/sso-manager-node/pulls)
-
-## License
-
-MIT License — see the repository for details.