From 0180d51ef801fd1fa0dec689405b136105f1b1f4 Mon Sep 17 00:00:00 2001
From: servius <servius@darksailor.dev>
Date: Fri, 20 Mar 2026 23:59:26 +0530
Subject: [PATCH] feat: Use sso only for vaultwarden

---
 nixos/tako/services/vaultwarden.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tako/services/vaultwarden.nix b/nixos/tako/services/vaultwarden.nix
index 96098135..39aa7dc7 100644
--- a/nixos/tako/services/vaultwarden.nix
+++ b/nixos/tako/services/vaultwarden.nix
@@ -33,9 +33,9 @@ in {
         ROCKET_PORT = port;
         SIGNUPS_ALLOWED = false;
         SSO_ENABLED = true;
-        SSO_ONLY = false;
+        SSO_ONLY = true;
         SSO_AUTHORITY = "https://auth.darksailor.dev";
-        SSO_SCOPES = "profile email offline_access";
+        SSO_SCOPES = "openid offline_access profile email";
         SSO_PKCE = true;
         SSO_ROLES_ENABLED = true;
         SSO_ROLES_DEFAULT_TO_USER = true;
-- 
2.54.0