diff --git a/docs/hub/access-vault.mdx b/docs/hub/access-vault.mdx
index e3ee6448..67a0fd7e 100644
--- a/docs/hub/access-vault.mdx
+++ b/docs/hub/access-vault.mdx
@@ -1,7 +1,7 @@
---
id: access-vault
title: Working with Vaults
-sidebar_position: 6
+sidebar_position: 7
---
# Working with Vaults
diff --git a/docs/hub/admin.mdx b/docs/hub/admin.mdx
index d4f5050d..b893147e 100644
--- a/docs/hub/admin.mdx
+++ b/docs/hub/admin.mdx
@@ -1,7 +1,7 @@
---
id: admin
title: Admin
-sidebar_position: 8
+sidebar_position: 9
---
# Admin
@@ -13,7 +13,7 @@ The license is bound to the instance and cannot be transferred to another instan
Every license has a number of seats and a validity period.
As an Hub administrator, you can view license information in the administration area.
-
+
### What Is a Seat? {/* #what-is-a-seat */}
@@ -106,7 +106,7 @@ The logs are displayed in a structured table containing the following columns:
- **Event** – The type of event that occurred.
- **Details** – Additional information about the event.
-
+
### Filtering Audit Logs {/* #filtering-audit-logs */}
@@ -155,7 +155,7 @@ Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about
This configuration defines default [Emergency Access](emergency-access.mdx) values for new or updated vaults.
-
+
Activate `Enable Emergency Access` and configure:
diff --git a/docs/hub/deployment/_category_.json b/docs/hub/deployment/_category_.json
index 936ae645..40f66e57 100644
--- a/docs/hub/deployment/_category_.json
+++ b/docs/hub/deployment/_category_.json
@@ -1,6 +1,6 @@
{
"label": "Deployment Cookbook",
- "position": 12,
+ "position": 13,
"link": {
"type": "doc",
"id": "hub/deployment/index"
diff --git a/docs/hub/deployment/index.mdx b/docs/hub/deployment/index.mdx
index 2d75a68b..a1383745 100644
--- a/docs/hub/deployment/index.mdx
+++ b/docs/hub/deployment/index.mdx
@@ -6,7 +6,7 @@ import DocCardList from '@theme/DocCardList';
# Deployment Cookbook
-This section collects recipes for running Cryptomator Hub in production. If you just want to try Hub, start with the [Quick Start](../quick-start.mdx) instead.
+This section collects recipes for running Cryptomator Hub in production. If you just want to try Hub, start with the [Quick Start](../quick-start.mdx) instead. For an end-to-end walkthrough from deployment to backups, see the [Self-Hosting Guide](../guides/self-hosting-guide.mdx).
:::tip
Cryptomator Hub is also offered as a hosted solution, including 99.5%-uptime guarantee and regular backups! Visit [cryptomator.org](https://cryptomator.org/for-teams/) for more information.
diff --git a/docs/hub/emergency-access.mdx b/docs/hub/emergency-access.mdx
index 843cdfe2..1c535c01 100644
--- a/docs/hub/emergency-access.mdx
+++ b/docs/hub/emergency-access.mdx
@@ -1,7 +1,7 @@
---
id: emergency-access
title: Emergency Access
-sidebar_position: 9
+sidebar_position: 10
---
# Emergency Access
@@ -15,7 +15,7 @@ Its process requires a group of trusted users (the "council") to approve the rec
When enough approvals are collected, the emergency change is completed and vault management access is restored.
Technically, this is implemented using key splitting based on **[Shamir's Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing)**.
-## Set Up Emergency Access
+## Set Up Emergency Access {/* #set-up-emergency-access */}
The feature can be activated for new and existing vaults:
@@ -23,7 +23,7 @@ The feature can be activated for new and existing vaults:
For the full workflow, see [Vault Management](vault-management.mdx#create-a-vault).
* **Existing vaults:** Open `Vault Details` and [configure Emergency Access](vault-management.mdx#emergency-access-council).
-## Starting a Recovery Process
+## Starting a Recovery Process {/* #starting-a-recovery-process */}
To start, open the `Emergency Access` page, select the vault, and start the desired process.
@@ -52,7 +52,7 @@ Starting a process automatically approves the process.
:::
-### Choose Vault Members
+### Choose Vault Members {/* #choose-vault-members */}
The `Choose Vault Members` process allows you to select new vault `Owners` or `Members`.
@@ -61,7 +61,7 @@ Users that are no longer part of the vault are shown as `Removed`.
-### Change Emergency Access Council
+### Change Emergency Access Council {/* #change-emergency-access-council */}
The `Change Emergency Access Council` process allows you to select a new council.
@@ -69,7 +69,7 @@ The minimum required number of members is configured in the [Admin settings](adm
-## Approve a Recovery Process
+## Approve a Recovery Process {/* #approve-a-recovery-process */}
To view or approve running Emergency Access processes, open the `Emergency Access` list.
If an Emergency Access process is running for a vault, the vault is displayed with a process button.
@@ -97,7 +97,7 @@ You can also inspect details before approving. Hover (or click) the segment ring
-## Complete a Recovery Process
+## Complete a Recovery Process {/* #complete-a-recovery-process */}
As soon as enough shares are available, the process button in the `Emergency Access` vault list shows `Complete now`.
@@ -114,14 +114,14 @@ Results by type:
After successful completion, the process is removed.
-## Abort a Recovery Process
+## Abort a Recovery Process {/* #abort-a-recovery-process */}
Running processes can be canceled in the dialog using `Abort this Process`.
-## Typical States and Notes
+## Typical States and Notes {/* #typical-states-and-notes */}
The following warning states can appear in the Emergency Access list:
@@ -132,6 +132,6 @@ The following warning states can appear in the Emergency Access list:
* `No Redundancy`: No fault tolerance in the council.
What to do: Increase the number of council members or reduce the required threshold so one unavailable user does not block recovery.
-## Audit Log Events
+## Audit Log Events {/* #audit-log-events */}
See [Emergency Access Audit Log events](admin.mdx#event-type-emergency-access).
diff --git a/docs/hub/guides/_category_.json b/docs/hub/guides/_category_.json
new file mode 100644
index 00000000..4d6588d4
--- /dev/null
+++ b/docs/hub/guides/_category_.json
@@ -0,0 +1,8 @@
+{
+ "label": "Guides",
+ "position": 3,
+ "link": {
+ "type": "doc",
+ "id": "hub/guides/index"
+ }
+}
diff --git a/docs/hub/guides/admin-guide.mdx b/docs/hub/guides/admin-guide.mdx
new file mode 100644
index 00000000..3440d6ca
--- /dev/null
+++ b/docs/hub/guides/admin-guide.mdx
@@ -0,0 +1,96 @@
+---
+id: admin-guide
+title: Admin Guide
+sidebar_position: 2
+description: Your first day as a Hub administrator — add users and groups, connect your identity provider, enable Emergency Access, and keep an eye on audit logs and license seats.
+---
+
+# Admin Guide
+
+This guide walks you through setting up a fresh Cryptomator Hub instance for your organization in about **20 minutes**.
+
+As a worked example, meet Alice: she administers Hub at the design agency Acme.
+Her instance is up and running, and now she adds her first users and a group, connects the company's identity provider, enables Emergency Access, and checks the audit log and license.
+
+## Before You Start {/* #before-you-start */}
+
+You need:
+
+* A running Hub instance — a local test instance from the [Quick Start](../quick-start.mdx) or a server deployment (managed or selfhosted)
+* An account with the `admin` [role](../user-group-management.mdx#roles), such as the initial admin account created during deployment.
+
+:::tip
+Not keen on hosting an instance yourself? Cryptomator Hub is also available as a [managed service](https://cryptomator.org/hub/managed/?utm_source=docs.cryptomator.org&utm_medium=referral&utm_campaign=admin-guide) with a free 30-day trial period — this guide applies there all the same.
+:::
+
+## Add Users and Groups {/* #add-users-and-groups */}
+
+Since version 2.0, users and groups are managed directly in Hub, via the `Users` and `Groups` entries in the sidebar.
+Alice creates accounts for Bob and Carol, each with username, email, and an initial password.
+She then creates the group *Designers* and adds both as members — sharing vaults with a group scales better than managing individual permissions.
+
+
+
+Bob and Carol can now log in and complete their account setup, as described in the [User Guide](user-guide.mdx#set-up-your-account).
+
+For more details, read [Create User](../user-group-management.mdx#create-user), [Create Group](../user-group-management.mdx#create-group), and [Manage Group Members](../user-group-management.mdx#manage-group-members).
+
+## Connect Your Identity Provider {/* #connect-your-identity-provider */}
+
+Creating users by hand is fine for a handful of people.
+Since Acme already manages its staff in a central directory, Alice instead connects Hub's bundled Keycloak to it, so users log in with their existing credentials and accounts stay in sync.
+
+
+
+The `Manage Keycloak` link takes Alice to the Keycloak admin console, where identity providers are configured on the `Identity providers` page:
+
+
+
+Depending on what your organization runs, follow the matching reference section:
+
+* [OpenID Connect](../keycloak.mdx#openid-connect) providers such as Microsoft Entra ID or Google Workspace.
+* [LDAP and Active Directory](../keycloak.mdx#ldap-and-active-directory) for user federation.
+* [Mapping groups to roles](../keycloak.mdx#mapping-groups-to-roles), e.g. to grant an *IT* directory group the `admin` role automatically.
+
+For more details, read [Connecting an External Identity Provider](../keycloak.mdx#connecting-an-external-identity-provider) and [External Identity Management](../user-group-management.mdx#enterprise-external-iam).
+
+## Enable Emergency Access {/* #enable-emergency-access */}
+
+What if Bob leaves Acme and the *Client Projects* vault has no other owner?
+Emergency Access, new in version 2.0, lets a council of trusted users jointly restore access to a vault.
+Alice enables it in the admin area and defines a default council, so every new vault gets Emergency Access conditions during creation.
+For existing vaults, owners set up the council in the vault details.
+
+
+
+:::info[Enterprise Feature]
+Emergency Access is available as an Enterprise feature.
+Visit [cryptomator.org](https://cryptomator.org/hub/) for more information.
+:::
+
+For more details, read [Emergency Access admin settings](../admin.mdx#emergency-access), [Set Up Emergency Access](../emergency-access.mdx#set-up-emergency-access), and the per-vault [Emergency Access Council](../vault-management.mdx#emergency-access-council).
+
+## Review the Audit Log {/* #review-the-audit-log */}
+
+The next morning, Alice verifies that everything went as intended.
+In the audit log, she filters for vault events and sees the creation of *Client Projects* and the access grants for Carol and the *Designers* group, each with actor and timestamp.
+
+
+
+For more details, read [Audit Logs](../admin.mdx#audit-logs), [Filtering Audit Logs](../admin.mdx#filtering-audit-logs), and the list of [Event Types](../admin.mdx#event-types).
+
+## Check Your License {/* #check-your-license */}
+
+Finally, Alice opens the license section of the admin area.
+With Bob and Carol having vault access, two seats are in use — a seat is occupied by every user who is assigned to at least one vault.
+The overview shows the used and licensed seats and where to upgrade before the team grows.
+
+
+
+For more details, read [License](../admin.mdx#license), [What Is a Seat?](../admin.mdx#what-is-a-seat), and [Updating Your License](../admin.mdx#updating-your-license).
+
+## Next Steps {/* #next-steps */}
+
+* Set up [backups](../operations.mdx#backup) before real data accumulates.
+* Harden logins with [session timeouts](../keycloak.mdx#session-timeouts) and [access restrictions](../keycloak.mdx#restricting-access-to-hub).
+* Send your team the [User Guide](user-guide.mdx) so they can get started on their own.
diff --git a/docs/hub/guides/index.mdx b/docs/hub/guides/index.mdx
new file mode 100644
index 00000000..aa38509a
--- /dev/null
+++ b/docs/hub/guides/index.mdx
@@ -0,0 +1,8 @@
+import DocCardList from '@theme/DocCardList';
+
+# Guides
+
+Step-by-step walkthroughs for the most common Cryptomator Hub workflows.
+Each guide follows a worked example from start to finish and links to the reference pages for details.
+
+
diff --git a/docs/hub/guides/self-hosting-guide.mdx b/docs/hub/guides/self-hosting-guide.mdx
new file mode 100644
index 00000000..401f24ce
--- /dev/null
+++ b/docs/hub/guides/self-hosting-guide.mdx
@@ -0,0 +1,70 @@
+---
+id: self-hosting-guide
+title: Self-Hosting Guide
+sidebar_position: 3
+description: Take Hub from a local playground to a production deployment — pick a recipe, deploy, set up backups, and keep the instance healthy.
+---
+
+# Self-Hosting Guide
+
+This guide takes you from trying Cryptomator Hub to running it in production for your organization.
+It sequences the existing [Deployment Cookbook](../deployment/index.mdx) and [Operations](../operations.mdx) references into one path; how long it takes depends mostly on your infrastructure — plan for **an hour** plus DNS.
+
+As a worked example, meet Alice: she liked the [Quick Start](../quick-start.mdx) playground and now deploys Hub for the design agency Acme, a team of about 20 people.
+
+:::tip
+Not keen on running Hub yourself? We also offer Hub as a [managed service](https://cryptomator.org/hub/managed/?utm_source=docs.cryptomator.org&utm_medium=referral&utm_campaign=self-hosting-guide) with uptime guarantee and regular backups.
+:::
+
+## Before You Start {/* #before-you-start */}
+
+Decide on these up front — they are hard to change later:
+
+* Two public URLs, one for Hub and one for Keycloak, with DNS records created before deploying.
+* TLS termination via a reverse proxy or ingress controller — Hub, Keycloak, and PostgreSQL must never be exposed directly.
+* Whether to run the bundled Keycloak and PostgreSQL or connect existing instances.
+
+The defaults are sized for small installations like Acme's; see [Sizing](../deployment/index.mdx#sizing) for larger teams.
+
+For more details, read [Before You Begin](../deployment/index.mdx#before-you-begin) — including why the public URLs must be final before the first start.
+
+## Choose a Recipe {/* #choose-a-recipe */}
+
+The [Deployment Cookbook](../deployment/index.mdx#recipes) offers three recipes:
+
+* [Docker Compose](../deployment/compose.mdx) — a single Docker host behind a Traefik reverse proxy with Let's Encrypt. The simplest production setup.
+* [Kubernetes](../deployment/kubernetes.mdx) — the Helm chart via the Helm CLI, for teams that already operate a cluster.
+* [Rancher](../deployment/rancher.mdx) — the same Helm chart installed through the Rancher UI.
+
+Acme has no Kubernetes cluster and 20 users fit comfortably on one virtual machine, so Alice picks Docker Compose.
+The rest of this guide follows that path.
+
+## Deploy with Docker Compose {/* #deploy-with-docker-compose */}
+
+Alice provisions a VM with Docker, points the two DNS records at it, and opens ports 80 and 443.
+She downloads the production Compose example, replaces the placeholders — hostnames, Let's Encrypt email, and freshly generated passwords and secrets — and starts the stack with `docker compose up -d`.
+Once all services are healthy, she signs in as `admin`, enters the license, and Hub is live at Acme's own domain.
+
+For more details, read [Prerequisites](../deployment/compose.mdx#compose-prerequisites), [Deploy](../deployment/compose.mdx#compose-deploy), and [Configuration](../deployment/compose.mdx#compose-configuration) — including which ports must never be published.
+
+## Set Up Backups {/* #set-up-backups */}
+
+All of Hub's state lives in PostgreSQL: vaults, encrypted keys, and the audit log in the `hub` database, users and credentials in the `keycloak` database.
+Alice schedules a nightly `pg_dumpall` via cron and moves the dumps off the VM.
+Then she does what most people skip: she [restores](../operations.mdx#restore) one dump onto a scratch instance to confirm the backup actually works — a backup that has never been restored is a hope, not a backup.
+
+For more details, read [Backup](../operations.mdx#backup) and [Restore](../operations.mdx#restore).
+
+## Keep It Healthy {/* #keep-it-healthy */}
+
+Running Hub is low-maintenance; these are the recurring and occasional tasks:
+
+* [Upgrading](../deployment/compose.mdx#compose-upgrading) — back up first, bump the pinned image tags, `docker compose up -d`.
+* [Verifying container images](../operations.mdx#verifying-container-images) before deploying new versions.
+* [Trusting a private certificate authority](../operations.mdx#trusting-a-private-certificate-authority) if your organization uses one.
+* [Changing the database password](../operations.mdx#changing-the-database-password) as part of credential rotation.
+
+## Next Steps {/* #next-steps */}
+
+* The instance is running, but empty — continue with the [Admin Guide](admin-guide.mdx) to add users, groups, and your identity provider.
+* Bookmark [Operations](../operations.mdx) as the reference for everything maintenance.
diff --git a/docs/hub/guides/user-guide.mdx b/docs/hub/guides/user-guide.mdx
new file mode 100644
index 00000000..a44747c8
--- /dev/null
+++ b/docs/hub/guides/user-guide.mdx
@@ -0,0 +1,79 @@
+---
+id: user-guide
+title: User Guide
+sidebar_position: 1
+description: From your first login to an unlocked vault — set up your account, create a vault, invite teammates, and unlock it with Cryptomator.
+---
+
+# User Guide
+
+This guide walks you through your first steps in Cryptomator Hub, from logging in for the first time to working with an unlocked vault, in about **15 minutes**.
+
+As a worked example, meet Bob: he just joined the design agency Acme, and his administrator Alice sent him the Hub URL and his login credentials.
+Bob will set up his account, create a vault called *Client Projects*, share it with his colleague Carol and the *Designers* group, and unlock it with the Cryptomator desktop app.
+
+## Before You Start {/* #before-you-start */}
+
+You need:
+
+* The URL of your organization's Hub instance and login credentials, both provided by your administrator.
+* The [Cryptomator app](https://cryptomator.org/downloads/?utm_source=docs.cryptomator.org&utm_medium=referral&utm_campaign=user-guide) for your OS. This guide uses the desktop app; Android and iOS work analogously, see [Working with Vaults](../access-vault.mdx).
+* The `create-vault` role to create a vault yourself. If the `Add` button in the vault list stays grayed out for you, ask your administrator for the [role](../user-group-management.mdx#roles) — or skip that section and continue with a vault someone shared with you.
+
+## Set Up Your Account {/* #set-up-your-account */}
+
+Bob opens the Hub URL, logs in with his credentials, and Hub greets him with a one-time account setup.
+
+
+
+The setup generates his personal *Account Key*.
+It is what links further browsers and Cryptomator apps to his account later, so he copies it into his password manager before finishing the setup.
+
+After finishing the setup, Bob lands on the vault list — Acme's is still empty.
+The `Add` button in the top right corner is the starting point for the next section: `Create New` opens the vault creation wizard.
+
+
+
+For more details, read [Account Setup](../your-account.mdx#account-setup) and [Account Key](../your-account.mdx#account-key).
+
+## Create a Vault {/* #create-a-vault */}
+
+Time for the first vault:
+
+1. In the vault list, Bob clicks `Add` → `Create New` and names the vault *Client Projects*.
+2. He follows the creation wizard and stores the displayed recovery key in his password manager — it restores access to the vault data if Hub is ever unavailable.
+3. In the last step, he downloads the vault template (a zip file, exactly once) and unzips it into the cloud storage folder the team already shares.
+
+
+
+For more details, read [Create a Vault](../vault-management.mdx#create-a-vault), [Show Recovery Key](../vault-management.mdx#show-recovery-key), and [Download Vault Template](../vault-management.mdx#download-vault-template).
+
+## Add Members {/* #add-members */}
+
+The vault is Bob's alone so far.
+In the vault details, he clicks into the search field of the `Shared with` section, picks Carol, and clicks `Add`.
+He then adds the *Designers* group the same way, so future team members get access automatically through their group membership.
+
+
+
+:::note
+When a member completes their account setup (or resets their account), a vault owner has to confirm the access once via the `Update Permissions` button before that member can unlock the vault.
+:::
+
+For more details, read [Share a Vault](../vault-management.mdx#share-a-vault), [Update Permissions](../vault-management.mdx#update-permissions), and [Web of Trust](../vault-management.mdx#web-of-trust) for verifying the identity of vault members.
+
+## Unlock the Vault {/* #unlock-the-vault */}
+
+To work with the encrypted data, Bob opens the Cryptomator desktop app, adds the vault by selecting the `vault.cryptomator` file from the shared cloud folder, and clicks `Unlock`.
+His browser opens for authentication, and since this is the first unlock from this device, Hub asks him to register it with a device name and his Account Key.
+After that, the vault unlocks, and Bob can reveal and edit the *Client Projects* files as usual.
+
+
+
+For more details, read [Unlocking a Vault](../access-vault.mdx#unlocking-a-vault), in particular [Register Device](../access-vault.mdx#register-device).
+
+## Next Steps {/* #next-steps */}
+
+* Lost access to a vault or Hub itself? See [Vault Recovery](../vault-recovery.mdx).
+* Review and revoke your registered browsers and apps under [Authorized Devices](../your-account.mdx#authorized-devices).
+* Curious how the zero-knowledge key management works? Read the [security architecture](/docs/security/hub.mdx).
diff --git a/docs/hub/introduction.mdx b/docs/hub/introduction.mdx
index 143f292c..041f79c1 100644
--- a/docs/hub/introduction.mdx
+++ b/docs/hub/introduction.mdx
@@ -18,6 +18,8 @@ If you are…
…an **administrator**:
* [Quick Start](quick-start.mdx) - how to try Cryptomator Hub on your machine.
+* [Admin Guide](guides/admin-guide.mdx) - a walkthrough of your first day as a Hub administrator.
+* [Self-Hosting Guide](guides/self-hosting-guide.mdx) - a walkthrough from playground to production deployment.
* [User & Group management](user-group-management.mdx) - how to manage users and groups.
* [License](admin.mdx#license) - how to manage your Hub license.
* [Deployment Cookbook](deployment/index.mdx) - how to deploy Cryptomator Hub for your team.
@@ -25,6 +27,7 @@ If you are…
…a **user**:
+* [User Guide](guides/user-guide.mdx) - a walkthrough from your first login to an unlocked vault.
* [Your Account](your-account.mdx) - how to manage your own account.
* [Managing Vaults](vault-management.mdx) - how to manage vaults.
* [Working with Vaults](access-vault.mdx) - how to use Hub vaults with Cryptomator apps to encrypt your data.
diff --git a/docs/hub/keycloak.mdx b/docs/hub/keycloak.mdx
index ebbb677e..8160da4f 100644
--- a/docs/hub/keycloak.mdx
+++ b/docs/hub/keycloak.mdx
@@ -1,7 +1,7 @@
---
id: keycloak
title: Keycloak
-sidebar_position: 11
+sidebar_position: 12
---
# Keycloak
diff --git a/docs/hub/new-features.mdx b/docs/hub/new-features.mdx
index 2b6b8615..a39b929a 100644
--- a/docs/hub/new-features.mdx
+++ b/docs/hub/new-features.mdx
@@ -1,7 +1,7 @@
---
id: new-features
title: New Features
-sidebar_position: 10
+sidebar_position: 11
---
# New Features
@@ -10,3 +10,5 @@ sidebar_position: 10
- [User & Group Management](/hub/user-group-management) — Manage users, groups, roles, and permissions directly in Hub
- [Emergency Access](/hub/emergency-access) — Restore access to a vault in case of account loss or ownership issues
+
+The [Admin Guide](guides/admin-guide.mdx) walks through both features in a worked example: see [Add Users and Groups](guides/admin-guide.mdx#add-users-and-groups) and [Enable Emergency Access](guides/admin-guide.mdx#enable-emergency-access).
diff --git a/docs/hub/operations.mdx b/docs/hub/operations.mdx
index 0e8d36e8..459950cc 100644
--- a/docs/hub/operations.mdx
+++ b/docs/hub/operations.mdx
@@ -1,11 +1,11 @@
---
title: Operations
-sidebar_position: 13
+sidebar_position: 14
---
# Operations
-All state of Cryptomator Hub lives in the PostgreSQL database: the `hub` database holds vaults, keys, and the audit log, the `keycloak` database holds users, groups, and credentials. Back up both, and always do so before upgrading.
+All state of Cryptomator Hub lives in the PostgreSQL database: the `hub` database holds vaults, keys, and the audit log, the `keycloak` database holds users, groups, and credentials. Back up both, and always do so before upgrading. For an end-to-end walkthrough from deployment to backups, see the [Self-Hosting Guide](guides/self-hosting-guide.mdx).
## Backup {/* #backup */}
diff --git a/docs/hub/quick-start.mdx b/docs/hub/quick-start.mdx
index ce6031d8..63d3c454 100644
--- a/docs/hub/quick-start.mdx
+++ b/docs/hub/quick-start.mdx
@@ -10,10 +10,6 @@ Want to see Cryptomator Hub in action before rolling it out to your team? This g
What you end up with is a playground, not a production system. It only listens on `localhost`, uses plain HTTP, and comes with default passwords. When you are ready for the real thing, head over to the [Deployment Cookbook](deployment/index.mdx).
-:::tip
-Not keen on running Hub yourself at all? We also offer Hub as a [managed service](https://cryptomator.org/for-teams/).
-:::
-
## Before You Start {/* #before-you-start */}
You need:
@@ -51,7 +47,7 @@ Hub greets you with a short onboarding on your first login:
1. **Choose a license.** For a local test, the *free trial* is what you want. You can claim it as often as you like. There are further free options for perpetual use on production installations as well.
1. **Save your Account Key.** Hub generates an [Account Key](your-account.mdx#account-key) in your browser. It's what you use to link further devices (browsers and Cryptomator apps) to your account, so keep it somewhere safe.
-That's it, you are in. Try [creating a vault](vault-management.mdx#create-a-vault), [adding a user](user-group-management.mdx#create-user), or [unlocking the vault](access-vault.mdx) from the Cryptomator desktop app with `http://localhost:8080` as the Hub address.
+That's it, you are in. Try [creating a vault](vault-management.mdx#create-a-vault), [adding a user](user-group-management.mdx#create-user), or [unlocking the vault](access-vault.mdx) from the Cryptomator desktop app. The [User Guide](guides/user-guide.mdx) and [Admin Guide](guides/admin-guide.mdx) walk you through these tasks using complete worked examples.
## Clean Up {/* #clean-up */}
@@ -69,4 +65,11 @@ docker compose down -v
## Next Steps {/* #next-steps */}
-Liked what you saw? Deploying Hub for your team requires a public address, TLS, and a plan for backups. The [Deployment Cookbook](deployment/index.mdx) guide covers all of that.
+Liked what you saw? Here is where to go next:
+
+* Deploy Hub for real — the [Self-Hosting Guide](guides/self-hosting-guide.mdx) takes you from this playground to a production deployment, and the [Deployment Cookbook](deployment/index.mdx) has the detailed recipes.
+:::tip
+Not keen on running Hub yourself at all? We also offer Hub as a [managed service](https://cryptomator.org/hub/managed/?utm_source=docs.cryptomator.org&utm_medium=referral&utm_campaign=quick-start) — including custom domain name, a 99.5%-uptime guarantee and regular backups.
+:::
+* Set up your organization — the [Admin Guide](guides/admin-guide.mdx) walks through users, groups, identity providers, and more.
+
diff --git a/docs/hub/user-group-management.mdx b/docs/hub/user-group-management.mdx
index f766f512..89fc5f1c 100644
--- a/docs/hub/user-group-management.mdx
+++ b/docs/hub/user-group-management.mdx
@@ -1,7 +1,7 @@
---
id: user-group-management
title: User & Group Management
-sidebar_position: 3
+sidebar_position: 4
---
# User & Group Management
@@ -34,7 +34,7 @@ To create a new user, click the "Create User" button in the user list. Fill in t
- **Roles**: Assign roles to the user (see [Roles](#roles))
- **Password**: Set an initial password for the user
-
+
After creation, the user can log in with their credentials and complete the [account setup](your-account.mdx#account-setup).
@@ -167,7 +167,7 @@ Connecting external identity and access management (IAM) solutions is available
Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about Enterprise features.
:::
-
+
Connecting Cryptomator Hub to an external identity manager allows you to:
diff --git a/docs/hub/vault-management.mdx b/docs/hub/vault-management.mdx
index a84f9a37..1269f6d7 100644
--- a/docs/hub/vault-management.mdx
+++ b/docs/hub/vault-management.mdx
@@ -1,7 +1,7 @@
---
id: vault-management
title: Vault Management
-sidebar_position: 5
+sidebar_position: 6
---
# Vault Management
@@ -43,7 +43,7 @@ To create a vault in Hub, navigate to the vault list and click on the `Create Va
Every vault has a name and optionally a description.
Fill out the form and continue the process by clicking the `Next` button in the right corner.
-
+
If the [Emergency Access](emergency-access.mdx) feature is enabled, the following step appears:
@@ -110,7 +110,7 @@ Open the [vault details](#vault-details) page to manage a vault.
If a user should have access to this vault, you need to share it with the user.
Click in the search field of the `Shared with` section, select it from the results list and click the `Add` button.
-
+
### Change Ownership {/* #change-ownership */}
diff --git a/docs/hub/vault-recovery.mdx b/docs/hub/vault-recovery.mdx
index 9e6bce2b..89dd79a4 100644
--- a/docs/hub/vault-recovery.mdx
+++ b/docs/hub/vault-recovery.mdx
@@ -1,7 +1,7 @@
---
id: vault-recovery
title: Vault Recovery
-sidebar_position: 7
+sidebar_position: 8
---
# Vault Recovery
diff --git a/docs/hub/your-account.mdx b/docs/hub/your-account.mdx
index f274bc9e..50d0ee73 100644
--- a/docs/hub/your-account.mdx
+++ b/docs/hub/your-account.mdx
@@ -1,7 +1,7 @@
---
id: your-account
title: Your Account
-sidebar_position: 4
+sidebar_position: 5
---
# Your Account
@@ -28,7 +28,7 @@ If you lose your account key, you have two options: If you have access to an aut
The very first time you log in to Cryptomator Hub, you're asked to set up your account.
This is a one-time process that takes just a minute.
-
+
In the setup your [Account Key](#account-key) is generated and displayed.
We recommend to copy your Account Key to a secure place (e.g. password manager), but you can always view it later in your profile from any trusted browser.
diff --git a/static/img/hub/access-keycloak-link.png b/static/img/hub/access-keycloak-link.png
index f4946622..3436a0a1 100644
Binary files a/static/img/hub/access-keycloak-link.png and b/static/img/hub/access-keycloak-link.png differ
diff --git a/static/img/hub/account-setup.png b/static/img/hub/account-setup.png
index 2e71e889..653d2653 100644
Binary files a/static/img/hub/account-setup.png and b/static/img/hub/account-setup.png differ
diff --git a/static/img/hub/admin-area-license.png b/static/img/hub/admin-area-license.png
index ad4089cf..427692c9 100644
Binary files a/static/img/hub/admin-area-license.png and b/static/img/hub/admin-area-license.png differ
diff --git a/static/img/hub/admin-emergency-access.png b/static/img/hub/admin-emergency-access.png
index 22021e74..844fb992 100644
Binary files a/static/img/hub/admin-emergency-access.png and b/static/img/hub/admin-emergency-access.png differ
diff --git a/static/img/hub/auditlogs-overview.png b/static/img/hub/auditlogs-overview.png
index a75bb32f..53bd06f8 100644
Binary files a/static/img/hub/auditlogs-overview.png and b/static/img/hub/auditlogs-overview.png differ
diff --git a/static/img/hub/create-vault.png b/static/img/hub/create-vault.png
index 74c472e9..d3fa1aac 100644
Binary files a/static/img/hub/create-vault.png and b/static/img/hub/create-vault.png differ
diff --git a/static/img/hub/keycloak-identity-providers.png b/static/img/hub/keycloak-identity-providers.png
new file mode 100644
index 00000000..c195454d
Binary files /dev/null and b/static/img/hub/keycloak-identity-providers.png differ
diff --git a/static/img/hub/user-create.png b/static/img/hub/user-create.png
index 2528b3cc..5aa48be5 100644
Binary files a/static/img/hub/user-create.png and b/static/img/hub/user-create.png differ
diff --git a/static/img/hub/user-guide-unlock-success-desktop.png b/static/img/hub/user-guide-unlock-success-desktop.png
new file mode 100644
index 00000000..6526aafa
Binary files /dev/null and b/static/img/hub/user-guide-unlock-success-desktop.png differ
diff --git a/static/img/hub/vault-details-search.png b/static/img/hub/vault-details-search.png
index 638865d4..ad71a599 100644
Binary files a/static/img/hub/vault-details-search.png and b/static/img/hub/vault-details-search.png differ
diff --git a/static/img/hub/vaultlist-empty.png b/static/img/hub/vaultlist-empty.png
new file mode 100644
index 00000000..8c4445c3
Binary files /dev/null and b/static/img/hub/vaultlist-empty.png differ