vaultwarden: use SSO with Kanidm

hosts/vps1/secrets/vaultwarden-env.age

@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> piv-p256 a1N2XA Ag/fE6bqn8kUPXEmxU7IcEaW4pRp8Ug5Tvj/49d3kN55
-TNVXUZ38JKTWte+31iuyGDy7P4zJkQzYb+g4QVXu1QM
--> 0S&-grease fn plj(( ShqRnf
-qZ/b2Xf2MA
---- 4HChQHR3R3I0DwDrx7DNmAa+gMhlzY18s3qyGndAitM
-H<1C>h><3E><>p<08>5<EFBFBD>vybdN<64>X<EFBFBD><16>ki]<5D>)<29>!p|<7C>8HL<48><4C>OM{<7B><><0F><><EFBFBD><0B>8<EFBFBD><38>s<EFBFBD><73>LF<4C><46>jM}<7D>:<02>]<5D><EFBFBD>Ǡk<C7A0><6B>%$<24><><EFBFBD>H<EFBFBD><48><EFBFBD>7R<37><52><EFBFBD>Q<EFBFBD>#<23>#<23>f<EFBFBD>*\<5C>X	F4<46>.}<7D>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD>{<7B>փpto<>,<2C><>yTs<54>M-<2D><><EFBFBD>X<EFBFBD><16>7<EFBFBD><37>H<EFBFBD><48>usfa[<5B>#<23>K<EFBFBD>}<7D><><0C>:K<>0q<30><71><EFBFBD><EFBFBD>B(o#?eG<1E>5
0<><30>Ҹ<><D2B8>ɧ<EFBFBD>P<EFBFBD>_gC<67>F
+-> piv-p256 a1N2XA A+JTQrgN4xxrQpLhyMtfq82/26DwsudKmxyE8gx9PlJU
+oZjXRvr2mza+28asKcXzSDU0em5edPpazk5dOLXrvZ8
+-> )z\cT7C|-grease v>P/r|O s\(zEXaF Q ,!Y2g+NM
+ZAEVPuF8OEWWNKFP+7IUrpaDydZDAFCRnj1vOdGiBf6BzgbicAAmIF4XgBQqpE5M
+JoCzgjdKB1kLOQB2PWRfJ02L93/zFQXm
+--- vcFS71G0ZZ1bU8dKgMmLMv5sUIi/TYjOu41EuDpJyXw
+:<3A><><15><><EFBFBD><7F>!<21>-<<11><1E>:<3A><><EFBFBD><EFBFBD>rg?<3F>N-i<><69><EFBFBD>?<3F>d<EFBFBD>Z2h<32>3<EFBFBD><0C>]

hosts/vps1/vaultwarden.nix

@@ -28,6 +28,9 @@ in
 
       rocketPort = 8222;
 
+      ssoEnabled = true;
+      ssoAuthority = "https://auth.vimium.com/oauth2/openid/vaultwarden";
+      ssoClientId = "vaultwarden";
       signupsAllowed = false;
       passwordIterations = 1000000;
       invitationsAllowed = true;