Closes lixmal#319. The README named LDAP and OIDC as supported backends and stopped there. The repo has had a working OpenLDAP and Keycloak setup for a while, but knowing that meant reading docker-compose.yml, .env.example and config.example.yml and piecing it together. CONFIGURATION also still said "see config.yml" after config.example.yml arrived, and the deployment section never mentioned that the app has no TLS listener at all. DEPLOYMENT now walks through each backend against the bundled service, and CONFIGURATION points at config.example.yml and calls out use_keyring and trust_proxy_headers, the two options that decide whether a deployment is sound rather than merely running. The OIDC instructions did not work as they stood. The compose file suggested issuer: 'http://keycloak:8080/realms/keepass', which the app accepts happily, but the browser is then redirected to the authorization endpoint on the same host and cannot resolve a compose service name. Keycloak is now pinned with --hostname so it names one issuer whichever address it is asked on, the issuer stays the public URL, and discovery_url points at the internal one. Verified by running the stack: the provider redirect lands on the published address, the token exchange goes over the compose network, and the login completes. The LDAP path was run the same way, wrong password included. Configuring a test backend takes two files, because two programs are being configured: .env sets the service up, config.yml tells the app how to reach it. config.yml does no variable expansion, so where they overlap the value has to be written out in both. That was implied by the walkthroughs but never stated, and is now a table of what each variable sets and what it has to be copied into, naming the three that do not follow the variable at all — the realm, client id and secret describe what tests/keycloak/realm.json already contains, and its redirect URI is fixed at port 8080. Two smaller corrections. The from-source build passed --target-dir release and then told the reader to run target/release/keepass4web-rs, which is not where that puts the binary; the RUSTFLAGS above it are x86-only and break an aarch64 build, so they are now shown separately with that said. And config.yml is not read as a set of appendable fragments: telling people to append an auth_backend block produces a duplicate key and the app refuses to start, so the instructions say to edit the existing lines. Ports, credentials and the Keycloak URL move into .env.example, which every variable now explains, and the compose file reads them instead of hard-coding.

Commits

Commits on Aug 28, 2026

docs: describe the LDAP and OIDC deployments, and fix the OIDC one