My kids play chess on Chess.com. It's a great product, but the account, the cloud and the ads are not something I want to hand to a nine-year-old — so I built Patzer: a self-hosted, open-source alternative that runs on a Pi, a NAS or an old laptop.

Last week I wrote about the tactic trainer (Patzer v7.19). This time it's about who gets to log in.

What shipped

A contributor added OIDC single sign-on to Patzer (PR #72), and it's in the released Docker image. If you already run an identity provider on your homelab — Authentik, Keycloak, Authelia, Pocket ID, whatever — your chess server can sit behind it.

A few details that matter if you self-host for a family:

  • Off by default. Nothing changes until you set OIDC_ISSUER and OIDC_CLIENT_ID. Existing installs see no difference.
  • SSO-only mode. OIDC_ONLY=true removes password login, sign-up and password reset entirely — in the UI and on the server. A fresh install started this way skips the setup wizard, and the first SSO login creates the admin. Your kids can't guess a password, because there is no password.
  • Admins from a provider group. OIDC_ADMIN_GROUP makes members of an IdP group admins, re-checked at every login. While no admin exists, only that group can sign in at all — so you can't lock yourself out with a misconfigured group.
  • Account linking. OIDC_AUTO_PROVISION and OIDC_MATCH_BY=username|email|none control whether a login creates an account or links to an existing one.
  • The boring-but-important part. Authorization code with PKCE, state and nonce, openid-client for discovery and ID-token validation, rate-limited callback, sanitized log lines, provider-supplied names cleaned. This is the kind of feature where the security details are the feature.

The design philosophy is the same as the rest of Patzer: the LLM never analyses, and the server never phones home. Now the login flow can stay in your LAN too.

docker run -d -p 8800:8800 -v patzer-data:/app/data --name patzer ghcr.io/Sikamikaniko123/patzer:latest

MIT licensed, EN·BG·ES·DE·RU out of the box. Repo: github.com/SikamikanikoBG/patzer