Email & external sign-in

External sign-in (OAuth/OIDC) and two-factor authentication harden access; the Mail module handles users' email (IMAP/SMTP).

OAuth & OIDC #

KV__AUTH__OAUTH_GOOGLE_ID=…
KV__AUTH__OAUTH_GOOGLE_SECRET=…
KV__AUTH__OAUTH_GITHUB_ID=…
KV__AUTH__OAUTH_GITHUB_SECRET=…

Note

Other OpenID Connect providers — Keycloak, GitLab, Authentik, your corporate directory — are not declared in the configuration file: they are added from Administration → Authentication, where their client secret is encrypted in the database. There is no environment variable for them.

Two-factor authentication #

TOTP (2FA) is available per user from their account settings.

Note

Google/GitHub only serve as a sign-in option here: no data is shared with these services beyond the authentication you enable.