Skip to content

Commit d77bc3a

Browse files
SiumauricioSiumauricio
authored
Merge pull request #130 from Dokploy/docs/enterprise
Docs/enterprise
2 parents ea03849 + 3e108f1 commit d77bc3a

File tree

11 files changed

+483
-3
lines changed

11 files changed

+483
-3
lines changed

‎apps/docs/content/docs/core/enterprise/audit-logs.txt‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Audit logs
3+
description: Track user actions and changes for compliance and security
4+
---
5+
6+
## What is logged
7+
8+
Typical events include:
9+
10+
- **Authentication** — Logins, logouts, failed attempts, SSO redirects.
11+
- **Users and access** — User creation, updates, deletion, role changes, invite/revoke.
12+
- **Resources** — Creation, update, and deletion of projects, applications, compose stacks, databases, domains, environment variables, and similar resources.
13+
- **Deployments** — Deploy triggers, rollbacks, and related actions.
14+
- **Settings** — Changes to organization, security, and whitelabel settings (where applicable).
15+
16+
Each entry usually includes:
17+
18+
- **Timestamp** (UTC)
19+
- **Actor** (user ID, email, or service account)
20+
- **Action** (e.g. `user.login`, `application.create`, `compose.deploy`)
21+
- **Resource** (type and identifier)
22+
- **Details** (e.g. old/new values or reason, when relevant)
23+
- **IP address** (when available)
24+
25+
## Accessing audit logs
26+
27+
1. Go to **Settings** → **Audit logs** (or **Organization** → **Audit logs** in Enterprise).
28+
2. Use filters by date range, user, action type, or resource.
29+
3. Export results (e.g. CSV or JSON) for external tools or compliance reviews.
30+
31+
## Retention and storage
32+
33+
- Retention period and storage backend (e.g. database, external logging) depend on your Enterprise agreement.
34+
- Configure retention and any archiving according to your compliance and security policies.
35+
36+
## Compliance
37+
38+
Audit logs help support:
39+
40+
- **SOC 2** — Evidence of access control and change management.
41+
- **GDPR** — Documentation of access to and changes in personal data and configurations.
42+
- **Internal policies** — Review of who changed what and when.
43+
44+
For retention, export formats, or integration with your SIEM or log pipeline, [contact us](https://dokploy.com/contact).

‎apps/docs/content/docs/core/enterprise/index.mdx‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Introduction
3+
description: Enterprise features for SSO, whitelabeling, and audit logs
4+
---
5+
6+
7+
## What's included
8+
9+
- **Single Sign-On (SSO)** — Integrate with Auth0, Keycloak, or other OIDC/SAML providers.
10+
{/* - **Whitelabeling** — Rebrand the UI with your logo, colors, and domain (self-hosted only) (). */}
11+
{/* - **Audit logs** — Track user actions and changes for compliance and security. */}
12+
13+
More Enterprise features are on the way. [Contact us](https://dokploy.com/contact) if you want early access or have specific requirements.
14+
15+
## Contact us
16+
17+
For pricing and to enable Enterprise features on your instance, get in touch with our team:
18+
19+
**[Contact us →](https://dokploy.com/contact)**
20+
21+
We'll help you configure SSO, whitelabeling, and audit logs for your organization.

‎apps/docs/content/docs/core/enterprise/license-keys.mdx‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: License Keys
3+
description: Activate and manage your Enterprise license
4+
---
5+
6+
To use Enterprise features (SSO, whitelabeling, audit logs, and more), you need a valid license issued by the Dokploy team.
7+
8+
By default, all Dokploy instances run in the standard edition. If you are interested in switching to the Enterprise version, [contact us](https://dokploy.com/contact). Once you receive your license key, you can activate it in your instance.
9+
10+
## Activating your license
11+
12+
1. Go to **Settings** → **License** (or **Organization** → **License** in Enterprise).
13+
2. Enter your license key and click **Activate**.
14+
15+
Your instance will then have access to Enterprise features for the duration of the license.
16+
17+
## How validation works
18+
19+
- The license is validated **every day** against our servers to verify that it is still valid.
20+
- The **only data** used for validation is the **IP address** of your server. We check it against our license server to confirm that the key is valid and active for that server.
21+
- No other data is sent or stored for license validation.
22+
23+
If your server’s IP changes, or you have questions about your license, [contact us](https://dokploy.com/contact).

‎apps/docs/content/docs/core/enterprise/sso/auth0.mdx‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
---
2+
title: Auth0
3+
description: Configure SSO with Auth0 (OIDC or SAML)
4+
---
5+
6+
<Tabs items={['SSO (OIDC)', 'SAML']}>
7+
<Tab value="SSO (OIDC)">
8+
9+
## 1. Create an application in Auth0
10+
11+
1. Log in to the [Auth0 Dashboard](https://manage.auth0.com/).
12+
2. Go to **Applications** → **Applications** → **Create Application**.
13+
3. Choose **Regular Web Application** and create it.
14+
4. Note your **Domain**, **Client ID**, and **Client Secret**.
15+
16+
## 2. Configure Dokploy
17+
18+
1. In Dokploy, go to **Settings** (or **Organization** / **Security** in Enterprise).
19+
2. Enable **SSO** and choose **OpenID Connect**.
20+
3. Enter:
21+
- **Provider**: myorg-name-auth0 (Unique)
22+
- **Issuer URL**: `https://YOUR_AUTH0_DOMAIN/` (Make sure add the trailing slash)
23+
- **Domain**: the domain users use to authenticate via Auth0 (e.g. your organization domain like `acme.com`), not the Dokploy instance URL
24+
- **Client ID**: from Auth0 application
25+
- **Client Secret**: from Auth0 application
26+
- **Scopes**: openid email profile
27+
4. Save.
28+
29+
## 3. Configure Auth0
30+
31+
1. In your application, go to **Settings**.
32+
2. Set **Allowed Callback URLs** to your Dokploy URL, for example:
33+
- `https://your-dokploy-domain.com/api/auth/callback/myorg-name-auth0`
34+
3. Set **Allowed Logout URLs** to:
35+
- `https://your-dokploy-domain.com`
36+
4. Set **Allowed Origins** to:
37+
- `https://your-dokploy-domain.com`
38+
5. Save changes.
39+
40+
## Troubleshooting (OIDC)
41+
42+
- **Redirect URI mismatch** — Ensure the callback URL in Dokploy matches exactly what is configured in Auth0 (including protocol and path).
43+
- **Invalid client** — Double-check Client ID and Client Secret, and that the application is a web application.
44+
- **Scopes** — Ensure Auth0 is configured to return `openid` and, if required, `email` and `profile`.
45+
46+
</Tab>
47+
<Tab value="SAML">
48+
49+
## 1. Create a SAML application in Auth0
50+
51+
1. Log in to the [Auth0 Dashboard](https://manage.auth0.com/).
52+
2. Go to **Applications** → **Applications** → **Create Application**.
53+
3. Choose **Regular Web Application** and create it.
54+
4. In the application, go to **Add Ons** → enable **SAML 2 Web App** and configure it, in the settings specify this callback URL: `https://your-dokploy-domain.com/api/auth/sso/saml2/callback/myorg-name-auth0-saml`.
55+
5. Next & Save.
56+
57+
## 2. Configure Dokploy
58+
59+
1. In Dokploy, go to **Settings** (or **Organization** / **Security** in Enterprise).
60+
2. Enable **SSO** and choose **SAML**.
61+
3. Enter:
62+
- **Provider**: myorg-name-auth0-saml (unique name for this provider)
63+
- **Issuer URL**: the Auth0 SAML Entity ID / Issuer located in `Add Ons` tab called `SAML 2 Web App` called `Entity ID` (e.g. `urn:auth0:your-tenant:your-app`)
64+
- **SSO URL**: the Auth0 SAML Single Sign-On URL located in `Add Ons` tab called `SAML 2 Web App` called `Single Sign-On URL` (e.g. `https://dev-ladsadb.us.auth0.com/samlp/wgJe9bWmwhVnuAC7eNtyUsiou4b6wxuf`)
65+
- **Certificate**: download the certificate active (x509) from the `Add Ons` tab called `SAML 2 Web App` called `Identity Provider Certificate` and paste it in the `Certificate` field.
66+
- **Federation Metadata XML**: copy the Identity Provider Metadata XML from the certificate active and paste it in the `Metadata XML` field.
67+
- **Domain**: the domain users use to authenticate via Auth0 (e.g. your organization domain like `acme.com`), not the Dokploy instance URL
68+
4. Save.
69+
70+
## 3. Configure Auth0 (SAML)
71+
72+
1. In your Auth0 SAML application, set the **Application Callback URL** (ACS URL) to your Dokploy SAML ACS URL, for example:
73+
- `https://your-dokploy-domain.com/api/auth/sso/saml2/callback/myorg-name-auth0-saml`
74+
2. In the **SAML 2 Web App** add-on, open **Settings** and paste the following JSON in the **Settings** (Application Settings) field. Replace `https://your-dokploy-domain.com` with your Dokploy base URL and `myorg-name-auth0-saml` with the **exact same provider name** you entered in Dokploy in step 2 (the callback URL path must match), so Dokploy can read email, display name, and other attributes:
75+
76+
```json
77+
{
78+
"audience": "https://your-dokploy-domain.com/saml/metadata",
79+
"recipient": "https://your-dokploy-domain.com/api/auth/sso/saml2/callback/myorg-name-auth0-saml",
80+
"destination": "https://your-dokploy-domain.com/api/auth/sso/saml2/callback/myorg-name-auth0-saml",
81+
"signResponse": true,
82+
"signAssertion": true,
83+
"nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
84+
"nameIdentifierProbes": [
85+
"email"
86+
],
87+
"mappings": {
88+
"email": "email",
89+
"displayName": "name",
90+
"givenName": "given_name",
91+
"surname": "family_name"
92+
}
93+
}
94+
```
95+
96+
4. Save.
97+
98+
## Troubleshooting (SAML)
99+
100+
- **ACS URL mismatch** — Ensure the callback/ACS URL in Auth0 matches exactly what Dokploy provides (including protocol and path).
101+
- **Certificate** — Use the full x509 certificate from Auth0 (PEM format); ensure no extra spaces or line breaks.
102+
- **Entity ID** — The Entity ID in Dokploy must match the Issuer/Entity ID configured in Auth0.
103+
104+
</Tab>
105+
</Tabs>
106+
107+
For help with your setup, [contact us](https://dokploy.com/contact).

‎apps/docs/content/docs/core/enterprise/sso/azure.mdx‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
---
2+
title: Azure AD (Microsoft Entra ID)
3+
description: Configure SSO with Azure AD / Microsoft Entra ID (OIDC or SAML)
4+
---
5+
6+
<Tabs items={['SSO (OIDC)', 'SAML']}>
7+
<Tab value="SSO (OIDC)">
8+
9+
## 1. Register an application in Azure
10+
11+
1. Log in to the [Azure Portal](https://portal.azure.com/).
12+
2. Go to **Microsoft Entra ID** (or **Azure Active Directory**) → **App registrations** → **New registration**.
13+
3. Enter a **Name** (e.g. Dokploy), choose supported account types, and set **Redirect URI** to **Web** with a placeholder for now (e.g. `https://your-dokploy-domain.com/api/auth/callback/myorg-name-azure`).
14+
4. Register and note the **Application (client) ID** and **Directory (tenant) ID**.
15+
5. Go to **Certificates & secrets** → **New client secret**, create a secret and note its **Value** (you won’t see it again).
16+
6. The **Issuer URL** for OpenID Connect is: `https://login.microsoftonline.com/{tenant-id}/v2.0` (replace `{tenant-id}` with your Directory (tenant) ID). Some setups expect a trailing slash.
17+
18+
## 2. Configure Dokploy
19+
20+
1. In Dokploy, go to **Settings** (or **Organization** / **Security** in Enterprise).
21+
2. Enable **SSO** and choose **OpenID Connect**.
22+
3. Enter:
23+
- **Provider**: myorg-name-azure (unique name for this provider)
24+
- **Issuer URL**: `https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0` (use your Directory (tenant) ID; add a trailing slash if required for discovery)
25+
- **Domain**: the domain users use to authenticate via Azure AD (e.g. your organization domain like `acme.com`), not the Dokploy instance URL
26+
- **Client ID**: the Application (client) ID from Azure
27+
- **Client Secret**: the client secret value from Certificates & secrets
28+
- **Scopes**: openid email profile
29+
4. Save.
30+
31+
## 3. Configure Azure
32+
33+
1. In your app registration, go to **Authentication**.
34+
2. Under **Web** → **Redirect URIs**, add:
35+
- `https://your-dokploy-domain.com/api/auth/callback/myorg-name-azure`
36+
3. Under **Front-channel logout URL** (optional), you can set:
37+
- `https://your-dokploy-domain.com`
38+
4. Go to **Token Configuration** and add optional claim, select **email**, **preferred_username** and **upn** from the list of claims.
39+
5. Save.
40+
41+
## Troubleshooting (OIDC)
42+
43+
- **Redirect URI mismatch** — Ensure the callback URL in Dokploy matches exactly what is configured in Azure (including protocol and path). Use the same **Provider** value in the path (e.g. `.../api/auth/callback/myorg-name-azure`).
44+
- **Invalid client** — Double-check Application (client) ID and client secret. Confirm the secret has not expired under **Certificates & secrets**.
45+
- **Tenant** — Use the correct Directory (tenant) ID in the Issuer URL. For multi-tenant apps, you may use `common` instead of the tenant ID (e.g. `https://login.microsoftonline.com/common/v2.0`).
46+
- **Scopes** — Ensure the app registration has the right API permissions (e.g. **OpenID permissions**, **User.Read**) if required for `openid`, `email`, and `profile`.
47+
48+
</Tab>
49+
<Tab value="SAML">
50+
51+
## 1. Create an Enterprise Application (SAML) in Azure
52+
53+
1. Log in to the [Azure Portal](https://portal.azure.com/).
54+
2. Go to **Microsoft Entra ID** → **Enterprise applications** → **New application** → **Create your own application** (or **Non-gallery application**).
55+
3. Enter a **Name** (e.g. Dokploy) and create.
56+
4. Go to **Single sign-on** → **SAML**.
57+
5. Note the **Identifier (Entity ID)** and **Login URL** (SSO URL). Under **SAML Certificates**, download or copy the **Certificate (Base64)** (x509) and download the **Federation Metadata XML** file.
58+
59+
## 2. Configure Dokploy
60+
61+
1. In Dokploy, go to **Settings** (or **Organization** / **Security** in Enterprise).
62+
2. Enable **SSO** and choose **SAML**.
63+
3. Enter:
64+
- **Provider**: myorg-name-azure-saml (unique name for this provider)
65+
- **Issuer URL**: the Azure SAML Entity ID (Identifier) from the Enterprise application (eg. `https://sts.windows.net/YOUR_TENANT_ID/`).
66+
- **SSO URL**: the Azure Login URL (Single Sign-On URL) (eg. `https://login.microsoftonline.com/YOUR_TENANT_ID/saml2`)
67+
- **Certificate**: the IdP signing certificate (x509 Base64) from Azure
68+
- **Federation Metadata XML**: the Federation Metadata XML file from Azure
69+
- **Domain**: the domain users use to authenticate via Azure AD (e.g. your organization domain like `acme.com`), not the Dokploy instance URL
70+
4. Save.
71+
72+
## 3. Configure Azure (SAML)
73+
74+
1. In your Enterprise application, go to **Single sign-on** → **SAML**.
75+
2. Under **Basic SAML Configuration**, set **Identifier (Entity ID)** if required (SP Entity ID from Dokploy) (eg. `https://your-dokploy-instance.com`).
76+
3. Set **Reply URL (Assertion Consumer Service URL)** to your Dokploy SAML ACS URL (eg. `https://your-dokploy-instance.com/api/auth/sso/saml2/callback/myorg-name-azure-saml`).
77+
3. Save.
78+
79+
## Troubleshooting (SAML)
80+
81+
- **ACS URL mismatch** — Ensure the Reply URL (ACS) in Azure matches exactly what Dokploy provides (including protocol and path).
82+
- **Certificate** — Use the Certificate (Base64) from Azure; paste as-is or convert to PEM if Dokploy expects PEM.
83+
- **Entity ID** — The Entity ID in Dokploy must match the Identifier (Entity ID) of the Azure Enterprise application.
84+
85+
</Tab>
86+
</Tabs>
87+
88+
For help with your setup, [contact us](https://dokploy.com/contact).

‎apps/docs/content/docs/core/enterprise/sso/index.mdx‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: Single Sign-On (SSO)
3+
description: Configure SSO with Auth0, Keycloak, or other OIDC/SAML providers
4+
---
5+
6+
Enterprise supports Single Sign-On via OpenID Connect (OIDC) and SAML. You can use Auth0, Keycloak, or any compatible identity provider.
7+
8+
Choose a provider below for step-by-step configuration:
9+
10+
- **[Auth0](/docs/core/enterprise/sso/auth0)** — Cloud identity platform
11+
- **[Azure AD (Microsoft Entra ID)](/docs/core/enterprise/sso/azure)** — Microsoft's cloud identity platform
12+
- **[Okta](/docs/core/enterprise/sso/okta)** — Cloud identity platform
13+
- **[Keycloak](/docs/core/enterprise/sso/keycloak)** — Open-source identity and access management
14+
15+
You can also use any other OIDC/SAML provider by configuring the endpoints and flow manually.
16+
17+
For other OIDC/SAML providers, use the same endpoints and flow; [contact us](https://dokploy.com/contact) if you need help.

‎apps/docs/content/docs/core/enterprise/sso/keycloak.mdx‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: Keycloak
3+
description: Configure SSO with Keycloak
4+
---
5+
6+
## 1. Create a client in Keycloak
7+
8+
1. Log in to your Keycloak Admin Console.
9+
2. Select your realm (or create one).
10+
3. Go to **Clients** → **Create client**.
11+
4. Set **Client ID** (e.g. `my-client-id`) and **Client type** to **OpenID Connect**.
12+
5. Set **Root URL** to your Dokploy base URL, e.g. `https://your-dokploy-domain.com`.
13+
6. Save.
14+
7. Open the client, set **Access type** to **confidential**, then open the **Credentials** tab and note the **Secret**.
15+
8. From **Realm settings** → **OpenID Endpoint Configuration**, note the **Issuer** (e.g. `https://keycloak.example.com/realms/your-realm`).
16+
17+
## 2. Configure Dokploy
18+
19+
1. In Dokploy, go to **Settings** (or **Organization** / **Security** in Enterprise).
20+
2. Enable **SSO** and choose **OpenID Connect**.
21+
3. Enter:
22+
- **Provider**: my-client-id (Unique)
23+
- **Issuer URL**: your Keycloak realm URL (e.g. `https://keycloak.example.com/realms/your-realm`)
24+
- **Domain**: the domain users use to authenticate via Keycloak (e.g. your organization domain like `acme.com`), not the Dokploy instance URL
25+
- **Client ID**: my-client-id
26+
- **Client Secret**: the secret from the Keycloak client Credentials tab
27+
- **Scopes**: openid email profile
28+
4. Save.
29+
30+
## 3. Configure Keycloak
31+
32+
1. In your Keycloak client, go to **Settings**.
33+
2. Set **Valid redirect URIs** to your Dokploy callback URL, for example:
34+
- `https://your-dokploy-domain.com/api/auth/callback/my-client-id`
35+
3. Set **Valid post logout redirect URIs** to:
36+
- `https://your-dokploy-domain.com`
37+
4. Set **Allowed Origins** to:
38+
- `https://your-dokploy-domain.com`
39+
5. Save changes.
40+
41+
## Troubleshooting
42+
43+
- **Redirect URI mismatch** — Ensure the callback URL in Dokploy matches exactly what is configured in Keycloak (including protocol and path). Use the same **Provider** value in the path (e.g. `.../api/auth/callback/myorg-name-keycloak`).
44+
- **Invalid client** — Double-check Client ID and Client Secret, and that the client is enabled and set to confidential access.
45+
- **Scopes** — Ensure the client is configured to request `openid` and, if required, `email` and `profile`.
46+
- **Attribute mapping** — If user email or name is missing, map Keycloak attributes (e.g. email, preferred_username) in Dokploy if your setup supports it.
47+
48+
For help with your setup, [contact us](https://dokploy.com/contact).

‎apps/docs/content/docs/core/enterprise/sso/meta.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"title": "SSO",
3+
"pages": [
4+
"auth0",
5+
"azure",
6+
"keycloak",
7+
"okta"
8+
]
9+
}

0 commit comments

Comments
 (0)