feat: update GPU browser examples and add OAuth configuration example

examples/README.md

@@ -8,6 +8,7 @@ These are the same examples shown in the [documentation](https://neko.m1k1o.net/
 | --- | --- |
 | [simple-browser](./simple-browser) | Firefox with commented options for persistent/custom profiles and other available browser images. |
 | [kiosk-browser](./kiosk-browser) | Firefox in kiosk mode that opens a fixed URL on startup (e.g. a streaming service or dashboard). Stateless by default. |
+| [oauth-browser](./oauth-browser) | Firefox authenticating members through an external OAuth 2.0 / OpenID Connect provider, configured via a mounted config.yaml. |
 | [gpu-nvidia-browser](./gpu-nvidia-browser) | Firefox with Nvidia GPU acceleration, with a commented "encode-only" option. |
 | [gpu-intel-browser](./gpu-intel-browser) | Firefox with Intel (VAAPI) GPU acceleration, with a commented "encode-only" option. |
 | [raspberry-pi-browser](./raspberry-pi-browser) | Firefox tuned for Raspberry Pi, with a commented hardware-encoding option. |

examples/oauth/config.yaml

@@ -0,0 +1,42 @@
+# See: https://neko.m1k1o.net/docs/v3/configuration/authentication#member.oauth
+member:
+  provider: "oauth"
+  oauth:
+    enabled: true
+    # When true, visiting the Neko root page immediately starts OAuth login.
+    auto_redirect: true
+    name: "Example SSO"
+    admin_emails: ["admin@example.com"]
+    user_emails: [] # if empty, any authenticated user is allowed to log in
+    client_id: "<client-id>"
+    client_secret: "<client-secret>"
+    # For OpenID Connect providers, issuer_url alone is enough - Neko
+    # discovers the authorization, token and user-info endpoints from
+    # /.well-known/openid-configuration.
+    issuer_url: "https://id.example.com"
+    scopes: ["openid", "profile", "email"]
+    # Configure these to match the JSON returned by the user-info endpoint.
+    subject_field: "sub"
+    username_field: "name"
+    avatar_field: "picture"
+    success_redirect: "/"
+    user_profile:
+      is_admin: false
+      can_login: true
+      can_connect: true
+      can_watch: true
+      can_host: true
+      can_share_media: true
+      can_access_clipboard: true
+      sends_inactive_cursor: true
+      can_see_inactive_cursors: false
+    admin_profile:
+      is_admin: true
+      can_login: true
+      can_connect: true
+      can_watch: true
+      can_host: true
+      can_share_media: true
+      can_access_clipboard: true
+      sends_inactive_cursor: true
+      can_see_inactive_cursors: true

examples/oauth/docker-compose.yaml

@@ -0,0 +1,23 @@
+# Neko - OAuth Example
+#
+# Authenticates users via an external OAuth 2.0 / OpenID Connect provider
+# instead of the built-in multiuser passwords. OAuth has many settings, so
+# they are set via a mounted config.yaml instead of environment variables.
+#
+# See: https://neko.m1k1o.net/docs/v3/configuration/authentication#member.oauth
+services:
+  neko:
+    image: "ghcr.io/m1k1o/neko/firefox:latest"
+    restart: "unless-stopped"
+    shm_size: "2gb"
+    ports:
+      - "8080:8080"
+      - "52000-52100:52000-52100/udp"
+    volumes:
+      - "./config.yaml:/etc/neko/neko.yaml"
+    environment:
+      NEKO_DESKTOP_SCREEN: '1920x1080@30'
+      NEKO_WEBRTC_EPR: 52000-52100
+      NEKO_WEBRTC_ICELITE: 1
+      # See: https://neko.m1k1o.net/docs/v3/configuration/webrtc#nat1to1
+      # NEKO_WEBRTC_NAT1TO1: <your-IP>

webpage/docs/installation/examples.md

@@ -35,7 +35,7 @@ Browse: [`examples/kiosk-browser`](https://github.com/m1k1o/neko/tree/main/examp
 
 For some workflows, passing the target URL directly to Firefox is more reliable than using homepage policies, because session restore can otherwise override the start page. See also: [Supervisord Configuration](/docs/v3/customization#supervisord).
 
-## Nvidia Browser {#gpu-nvidia-browser}
+## Nvidia GPU Browser {#gpu-nvidia-browser}
 
 Neko supports hardware acceleration using Nvidia GPUs. To use this feature, you need to have the Nvidia Container Toolkit installed on your system. You can find the installation instructions [here](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html). Check if your GPU supports hardware encoding with [this list](https://developer.nvidia.com/video-encode-decode-gpu-support-matrix).
 
@@ -50,7 +50,7 @@ Browse: [`examples/gpu-nvidia-browser`](https://github.com/m1k1o/neko/tree/main/
 
 See available [Nvidia Docker Images](/docs/v3/installation/docker-images#nvidia).
 
-## Intel Browser {#gpu-intel-browser}
+## Intel GPU Browser {#gpu-intel-browser}
 
 Neko supports hardware acceleration using Intel GPUs via VAAPI. This requires the host to expose `/dev/dri` and have the Intel graphics driver installed.
 
@@ -85,6 +85,20 @@ Browse: [`examples/arm64-browser`](https://github.com/m1k1o/neko/tree/main/examp
 
 See supported architectures and per-app availability in the [Availability Matrix](/docs/v3/installation/docker-images#availability).
 
+## OAuth {#oauth}
+
+Authenticates members through an external OAuth 2.0 / OpenID Connect provider instead of the built-in multiuser passwords. OAuth has many settings, so this example sets them via a mounted `config.yaml` instead of environment variables.
+
+Browse: [`examples/oauth`](https://github.com/m1k1o/neko/tree/main/examples/oauth)
+
+```yaml title="docker-compose.yaml" file=<rootDir>/examples/oauth/docker-compose.yaml
+```
+
+```yaml title="config.yaml" file=<rootDir>/examples/oauth/config.yaml
+```
+
+See [OAuth 2.0 Provider](/docs/v3/configuration/authentication#member.oauth) for all available options.
+
 ## TURN Server {#turn-server}
 
 WebRTC needs a direct connection between the client and the server. When that is not possible (e.g. both sides are behind restrictive NATs or firewalls), a [TURN server](/docs/v3/configuration/webrtc#iceservers) relays the traffic instead. This example runs a [Coturn](https://github.com/coturn/coturn) TURN server alongside Neko.