homelab-codex-ws/services/vikunja/config.yml

# Vikunja runtime config — committed to git (secret-free).
#
# Database, public URL, JWT secret and the OIDC client SECRET are supplied via
# environment variables (see docker-compose.yml + .env). Only non-secret OIDC
# provider metadata lives here.
#
# Env vars override matching keys, so anything secret stays out of this file.

auth:
  openid:
    enabled: true
    # MUST end with a trailing slash — matches Vikunja's redirect handling.
    redirecturl: "https://vikunja.kapala.org/auth/openid/"
    providers:
      forgejo:
        name: "Forgejo"
        # authurl MUST have a trailing slash — it must match the OIDC issuer
        # exactly or discovery fails.
        authurl: "https://forgejo.kapala.org/"
        clientid: "15ad6f99-b8ca-48dc-92b9-97907ddc4367"
        # clientsecret is injected via
        # VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET (.env) — never here.
        scope: "openid profile email"