OIDC + SSO

.env.example

@@ -40,6 +40,37 @@
 # Leave empty to auto-generate and persist to save.json
 # OVERLORD_AGENT_TOKEN=
 
+# ============================================
+# OPTIONAL: OIDC / SSO login
+# ============================================
+# Generic OIDC works with providers such as Authentik, Authelia, Keycloak, Zitadel, and Dex.
+# Configure your provider callback/redirect URI as:
+#   https://YOUR_OVERLORD_HOST/api/oidc/callback
+# Keep local username/password login enabled as a fallback.
+# OVERLORD_OIDC_ENABLED=true
+# OVERLORD_OIDC_LABEL=Sign in with SSO
+# OVERLORD_OIDC_ISSUER=https://auth.example.com/application/o/overlord/
+# OVERLORD_OIDC_CLIENT_ID=overlord
+# OVERLORD_OIDC_CLIENT_SECRET=change-me
+# OVERLORD_OIDC_REDIRECT_URI=https://overlord.example.com/api/oidc/callback
+# OVERLORD_OIDC_DEFAULT_ROLE=viewer
+# OVERLORD_OIDC_ALLOWED_DOMAINS=example.com
+# OVERLORD_OIDC_ADMIN_GROUPS=overlord-admins
+# OVERLORD_OIDC_OPERATOR_GROUPS=overlord-operators
+# OVERLORD_OIDC_VIEWER_GROUPS=overlord-viewers
+
+# ============================================
+# OPTIONAL: Login screen branding
+# ============================================
+# Use a logo URL, or leave it empty and set a Font Awesome icon class.
+# Logo URLs may be absolute http(s) URLs or root-relative paths such as /assets/logo.png.
+# OVERLORD_LOGIN_BRAND_NAME=Acme SOC
+# OVERLORD_LOGIN_TITLE=Welcome to Acme Overlord
+# OVERLORD_LOGIN_SUBTITLE=Sign in with your Acme identity
+# OVERLORD_LOGIN_LOGO_URL=/assets/acme-logo.png
+# OVERLORD_LOGIN_LOGO_ALT=Acme logo
+# OVERLORD_LOGIN_ICON_CLASS=fa-solid fa-shield-halved
+
 # ============================================
 # ADVANCED: Custom TLS certificates
 # ============================================