# Schleuse

> A small but polished sidecar identity provider: password and passkey (WebAuthn) authentication, email verification and 2FA, an OIDC provider (Authorization Code + PKCE) for downstream apps, an admin panel and four UI locales — in one self-contained container with PostgreSQL or SQLite behind it.

Schleuse is self-hosted and configured entirely through `NUXT_*` environment
variables: there is no settings table and no admin UI for OIDC clients, so an
instance is reproducible from its compose file. Every link below is the page's
markdown source. The whole documentation in one file is at
[llms-full.txt](https://schleuse.meowww.dev/llms-full.txt).

## Getting started

- [Home](https://schleuse.meowww.dev/index.md): what Schleuse is, and the two-command Docker quick start.
- [Quick start](https://schleuse.meowww.dev/guide/getting-started.md): running the published image, a minimal compose file, local development, and the first admin.
- [Configuration](https://schleuse.meowww.dev/guide/configuration.md): every environment variable — database, JWT keys, SMTP, password policy, rate limits, CAPTCHA, metrics, provisioning tokens, locales, theme — with defaults and the boot-time validation that rejects contradictory config.

## Features

- [OIDC provider](https://schleuse.meowww.dev/guide/oidc.md): discovery and JWKS, client definitions, mandatory PKCE and its one exemption, scopes and claims, per-application roles, JWT access tokens with resource indicators, PAR, introspection, revocation and back-channel logout.
- [MCP servers behind Schleuse](https://schleuse.meowww.dev/guide/mcp.md): the complete recipe for securing a Model Context Protocol server — register the client, declare the server as a resource, return `401` with a pointer, verify the token's `aud`.
- [Admin panel](https://schleuse.meowww.dev/guide/admin.md): first-admin bootstrap, user administration, role assignment, the audit log, the live env Configurator, and SMTP diagnostics.
- [Email templates](https://schleuse.meowww.dev/guide/email-templates.md): which mails are sent, the placeholders, and how to override subject, body and layout per locale.
- [Webhooks](https://schleuse.meowww.dev/guide/webhooks.md): notify your own services when something happens — subscriptions name audit events, deliveries are signed with HMAC-SHA256, and the admin can test an endpoint without touching a real account.
- [Multilingual](https://schleuse.meowww.dev/guide/multilingual.md): the locale resolution cascade, UI translation, email localisation, and how to add a locale.

## Operations

- [Deployment](https://schleuse.meowww.dev/guide/deployment.md): production checklist, image tags, reverse proxies (Caddy, nginx, Traefik), TLS, volumes, secret and key rotation, upgrades with their pre-flight steps, health checks and Prometheus metrics.
- [Console (CLI)](https://schleuse.meowww.dev/guide/cli.md): the `schleuse user …` command in the image: list, create, set a password, grant admin, suspend, reset 2FA, delete; locked-out-admin recovery; audit trail and why shell access is the authorization.
- [Migrating users in](https://schleuse.meowww.dev/guide/migration.md): the provisioning API, what happens to the `sub`, converting Keycloak / bcrypt / argon2 password hashes, dry runs, and what does not come across.
- [Backup & restore](https://schleuse.meowww.dev/guide/backup-restore.md): what to back up (database *and* the keys in `/app/data`), `pg_dump` and SQLite online backup, the restore path, and how to verify one.
- [Security](https://schleuse.meowww.dev/guide/security.md): password handling (argon2id), session and token model, two-factor policy, CSRF, rate limiting and the CAPTCHA, security headers, and the hardening checklist.

## Reference

- [API reference](https://schleuse.meowww.dev/reference/api.md): every HTTP endpoint — health, authentication, account self-service, WebAuthn, OIDC, admin, the app API and the provisioning API — with request and response shapes.

## Optional

- [Changelog](https://schleuse.meowww.dev/changelog): release notes per version. HTML only — the markdown source is a build-time transclusion.
- [Source repository](https://gitlab.com/meowww_dev/schleuse): code, issues and the container images.