From fe914e2de48c0f580faf8a58138d6d6c801a0d04 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Tue, 6 Oct 2026 00:18:56 +0100
Subject: [PATCH] NG: enable sso for VW

---
 k8s-ng/core/vaultwarden/deployment.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/k8s-ng/core/vaultwarden/deployment.yaml b/k8s-ng/core/vaultwarden/deployment.yaml
index 4330ed4..11e26eb 100644
--- a/k8s-ng/core/vaultwarden/deployment.yaml
+++ b/k8s-ng/core/vaultwarden/deployment.yaml
@@ -25,11 +25,24 @@ spec:
               cpu: 100m
             limits:
               memory: 512Mi
+          # SSO is switched on by the optional Secret vaultwarden-sso, which holds
+          # SSO_ENABLED=true and SSO_CLIENT_SECRET (the secret of the Keycloak client
+          # "Vaultwarden"). Without it Vaultwarden starts with SSO off.
+          envFrom:
+            - secretRef:
+                name: vaultwarden-sso
+                optional: true
           env:
             - name: DOMAIN
               value: https://vw.btwiusearch.net
             - name: ORG_GROUPS_ENABLED
               value: "true"
+            - name: SSO_AUTHORITY
+              value: https://auth.hexor.cy/auth/realms/hexor
+            - name: SSO_CLIENT_ID
+              value: Vaultwarden
+            - name: SSO_SCOPES
+              value: openid profile email offline_access
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef: