Set up email, passkeys and SSO

Set each variable in the server’s .env, then run docker compose up -d (Run the sync server).

Email

STERNWAY_SMTP_URL=smtp://user:password@mail.example.com:587

The server then sends invite emails and passkey notices, and people can verify their email address with a mailed code. Without it everything else works, and invites go by link.

Passkeys

Passkeys need HTTPS. They’re bound to the host of STERNWAY_PUBLIC_URL, and that URL’s origin is the only one accepted.

• STERNWAY_WEBAUTHN_RP_ID names a parent domain instead (example.com for https://sync.example.com), so passkeys keep working if the server moves to another subdomain.
• STERNWAY_WEBAUTHN_ORIGINS adds origins when the server has more than one address.

Caution

Moving the server outside that domain stops every passkey. People then sign in with their password and add their passkeys again.

Single sign-on

Teams set up SAML themselves in the desktop app. The server only needs the right STERNWAY_PUBLIC_URL and a proxy that passes /api/v1/auth/saml/…. Server-wide OpenID Connect is STERNWAY_OIDC. See Set up single sign-on.