[Feature]: Env vars for OIDC setup

[nebula-it]

Is your feature request related to a problem? Please describe.

Currently, you have to signup with an email/password and then configure the OIDC.

Describe the solution you'd prefer

It should be possible to configure OIDC using env vars, here is a list of OIDC env vars we'll need:

DISABLE_EMAIL_LOGIN: "true"
OIDC_AUTH_ENABLED: "true"
OIDC_CONFIGURATION_URL: https://example.com/.well-known/openid-configuration
OIDC_CLIENT_ID: 
OIDC_CLIENT_SECRET: 
OIDC_PROVIDER_NAME: Provider
OIDC_AUTO_REDIRECT: "true"
OIDC_ADMIN_GROUP: "app_admin"
OIDC_USER_GROUP: "app_users"

[CodeWithCJ]

Thanks for the suggestion. For now, I don’t plan to implement this. Some users have already raised concerns about having too many env vars, while others prefer it this way, so it’s a tricky balance.

I also believe there should always be a local admin account available, even when using OIDC, so the app can still be accessed if OIDC is misconfigured or unavailable.

Since this is a one-time setup and has limited impact, I’m going to defer on this unless there’s a compelling reason to revisit it. Thanks for understanding.

local account gets mapped to OIDC if it sees same email address.

[nebula-it]

Some users have already raised concerns about having too many env vars

This is interesting, as long as the env vars are documented I dont see any issues with having too many. Almost all of the projects I self host follow this.

unless there’s a compelling reason

The biggest one, for myself atleast, is having as much config as possible in code. In my case all of this is deployed using argoCD onto k8s cluster and I prefer to keep as much app config as possible in it, so once the app starts there is minimal config to do.

[Tarow]

I'd like to +1 this request.
Having an external IdP is great to avoid separate user-management for each app (including admin accounts).

Having OIDC env variables with claim based role mapping allows for a fully automated deployment with zero "click-ops".
I think a lot of people follow GitOps practises and use Ansible etc. to roll out their stacks, so automated OIDC setup would be a blessing.

[CodeWithCJ]

will check it out

[nikpcenicni]

@CodeWithCJ happy to work on the implementation of this. Just want to confirm before starting as per our previous discussion on ENV vars.

[CodeWithCJ]

yes appreciate your help. please feel free to submit PR on this. OIDC can be exception to be added as env. but UI should still continue to be there.

[nebula-it]

@nikpcenicni Thank you for taking this on. One recommendation I have is that we should use a standard prefix for all env vars used by SparkyFitness, maybe SF so OIDC_CLIENT_ID will be SF_OIDC_CLIENT_ID.

I'll leave the prefix decision with @CodeWithCJ

[CodeWithCJ]

SPARKY_FITNESS_ is the prefix of existing naming convention. yeah its long but it is what it is now