Cryptomator Hub 2.0

docs/hub/access-vault.mdx

@@ -1,7 +1,7 @@
 ---
 id: access-vault
 title: Working with Vaults
-sidebar_position: 6
+sidebar_position: 7
 ---
 
 # Working with Vaults
@@ -21,29 +21,25 @@ As described in [open an existing vault](/docs/desktop/adding-vaults.mdx#open-an
 
 To unlock the vault, click on the large `Unlock` button in the center of Cryptomator's main window.
 
-<Image src="/img/hub/unlock-click-unlock.png" alt="Click 'Unlock' to unlock a Hub vault with the Desktop app" width="715" height="541" />
+<Image src="/img/hub/unlock-auth-desktop-app.png" alt="Click 'Unlock' to unlock a Hub vault with the Desktop app" width="715" height="541" />
 
 ### 2. Authenticate {/* #authenticate */}
 
 Cryptomator should open your default browser for authentication. If you're not already logged in, you need to provide your user credentials, e.g., by entering your username and password or by inserting your key when WebAuthn is enabled.
 
-<Image src="/img/hub/unlock-authenticate.png" alt="After your browser asks for credentials, enter your username and password" width="1280" height="567" />
+<Image src="/img/hub/unlock-authenticate.png" alt="After your browser asks for credentials, enter your username and password" width="1440" height="620" />
 
 ### 3. Register Device {/* #register-device */}
 
-If you just setup your account, a vault owner needs to grant you access for the requested vault as described [here](vault-management.mdx#update-permissions). Retry unlocking the vault after the vault owner granted you access.
-
-<Image src="/img/hub/unlock-access-denied.png" alt="Access is denied since it has not been granted by a vault owner yet" width="715" height="541" />
-
 If you connect to Hub with this device for the first time, you need to register it.
 
 Desktop
 
-<Image src="/img/hub/unlock-register-device-desktop.png" alt="Register your device by entering the setup code and a name for it" width="715" height="541" />
+<Image src="/img/hub/unlock-register-device-desktop-app.png" alt="Register your device by entering the setup code and a name for it" width="715" height="541" />
 
 Hub
 
-<Image src="/img/hub/unlock-register-device-hub.png" alt="Hub requests device registration" width="1280" height="374" />
+<Image src="/img/hub/unlock-register-device-hub.png" alt="Hub shows the new device view during unlock" width="512" height="184" />
 
 Enter a name for the device to identify it later on and the [Account Key](your-account.mdx#account-key) which was generated during the account setup. You can also find it in the [account settings](your-account.mdx#profile-page).
 
@@ -55,7 +51,7 @@ You are all set up and an unlock should be successful from now on. You can then
 
 Desktop
 
-<Image src="/img/hub/unlock-successfull-desktop.png" alt="Desktop shows unlock successful" width="715" height="541" />
+<Image src="/img/hub/unlock-success-desktop-app.png" alt="Desktop shows unlock successful" width="715" height="541" />
 
 Hub
 

docs/hub/admin.mdx

@@ -1,7 +1,7 @@
 ---
 id: admin
 title: Admin
-sidebar_position: 8
+sidebar_position: 9
 ---
 
 # Admin
@@ -13,7 +13,7 @@ The license is bound to the instance and cannot be transferred to another instan
 Every license has a number of seats and a validity period.
 As an Hub administrator, you can view license information in the administration area.
 
-<Image src="/img/hub/admin-area-license.png" alt="Administration area" width="1440" height="574" />
+<Image src="/img/hub/admin-area-license.png" alt="Administration area" width="2880" height="1800" />
 
 ### What Is a Seat? {/* #what-is-a-seat */}
 
@@ -106,7 +106,7 @@ The logs are displayed in a structured table containing the following columns:
 - **Event** – The type of event that occurred.
 - **Details** – Additional information about the event.
 
-<Image src="/img/hub/auditlogs-overview.png" alt="Audit Logs Table View" width="1238" height="858" />
+<Image src="/img/hub/auditlogs-overview.png" alt="Audit Logs Table View" width="2880" height="1720" />
 
 ### Filtering Audit Logs {/* #filtering-audit-logs */}
 
@@ -149,17 +149,13 @@ Additionally, any existing trust chains that included the user will be broken, r
 
 ## Emergency Access {/* #emergency-access */}
 
-:::info[Early Access]
-Emergency Access is currently in **early access** and will be fully available in version 2.0.0.
-:::
-
 :::info[Enterprise Feature]
 Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about Enterprise features.
 :::
 
 This configuration defines default [Emergency Access](emergency-access.mdx) values for new or updated vaults.
 
-<Image src="/img/hub/admin-emergency-access.png" alt="Emergency Access" width="1440" height="658" />
+<Image src="/img/hub/admin-emergency-access.png" alt="Emergency Access" width="2880" height="1800" />
 
 Activate `Enable Emergency Access` and configure:
 

docs/hub/deployment/_category_.json

@@ -1,6 +1,6 @@
 {
   "label": "Deployment Cookbook",
-  "position": 12,
+  "position": 13,
   "link": {
     "type": "doc",
     "id": "hub/deployment/index"

docs/hub/deployment/index.mdx

@@ -6,7 +6,7 @@ import DocCardList from '@theme/DocCardList';
 
 # Deployment Cookbook
 
-This section collects recipes for running Cryptomator Hub in production. If you just want to try Hub, start with the [Quick Start](../quick-start.mdx) instead.
+This section collects recipes for running Cryptomator Hub in production. If you just want to try Hub, start with the [Quick Start](../quick-start.mdx) instead. For an end-to-end walkthrough from deployment to backups, see the [Self-Hosting Guide](../guides/self-hosting-guide.mdx).
 
 :::tip
 Cryptomator Hub is also offered as a hosted solution, including 99.5%-uptime guarantee and regular backups! Visit [cryptomator.org](https://cryptomator.org/for-teams/) for more information.

docs/hub/emergency-access.mdx

@@ -1,15 +1,11 @@
 ---
 id: emergency-access
 title: Emergency Access
-sidebar_position: 9
+sidebar_position: 10
 ---
 
 # Emergency Access
 
-:::info[Early Access]
-This feature is currently in **early access** and will be fully available in version 2.0.0.
-:::
-
 :::info[Enterprise Feature]
 Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about Enterprise features.
 :::
@@ -19,19 +15,19 @@ Its process requires a group of trusted users (the "council") to approve the rec
 When enough approvals are collected, the emergency change is completed and vault management access is restored.
 Technically, this is implemented using key splitting based on **[Shamir's Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing)**.
 
-## Set Up Emergency Access
+## Set Up Emergency Access {/* #set-up-emergency-access */}
 
 The feature can be activated for new and existing vaults:
 
 * **New vaults:** During vault creation, use the `Define Emergency Access Conditions` step.
   For the full workflow, see [Vault Management](vault-management.mdx#create-a-vault).
 * **Existing vaults:** Open `Vault Details` and [configure Emergency Access](vault-management.mdx#emergency-access-council).
 
-## Starting a Recovery Process
+## Starting a Recovery Process {/* #starting-a-recovery-process */}
 
 To start, open the `Emergency Access` page, select the vault, and start the desired process.
 
-<Image src="/img/hub/emergency_access_vault_list.png" alt="Emergency Access Vault List" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list.png" alt="Emergency Access Vault List" width="2880" height="1800" />
 
 There are two process types:
 
@@ -56,38 +52,38 @@ Starting a process automatically approves the process.
 :::
 
 
-### Choose Vault Members
+### Choose Vault Members {/* #choose-vault-members */}
 
 The `Choose Vault Members` process allows you to select new vault `Owners` or `Members`.
 
 Users that are no longer part of the vault are shown as `Removed`.
 
-<Image src="/img/hub/emergency_access_change_permissions_start.png" alt="Emergency Access Vault List" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_change_permissions_start.png" alt="Emergency Access Vault List" width="2880" height="1800" />
 
 
-### Change Emergency Access Council
+### Change Emergency Access Council {/* #change-emergency-access-council */}
 
 The `Change Emergency Access Council` process allows you to select a new council.
 
 The minimum required number of members is configured in the [Admin settings](admin.mdx#emergency-access).
 
-<Image src="/img/hub/emergency_access_change_council_start.png" alt="Emergency Access Vault List" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_change_council_start.png" alt="Emergency Access Vault List" width="2880" height="1800" />
 
-## Approve a Recovery Process
+## Approve a Recovery Process {/* #approve-a-recovery-process */}
 
 To view or approve running Emergency Access processes, open the `Emergency Access` list.
 If an Emergency Access process is running for a vault, the vault is displayed with a process button.
 If you haven't approved the process, the button includes `Approve now`.
 
-<Image src="/img/hub/emergency_access_vault_list_change_council_approve_now.png" alt="Emergency Access Vault List Approve Now" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_change_council_approve_now.png" alt="Emergency Access Vault List Approve Now" width="2880" height="1800" />
 
 Approve a running process in three steps:
 
 1. Open the vault in the `Emergency Access` list.
 2. Click `Approve now` to open the `Approve Emergency Access` dialog.
 3. Review the details and click `Approve`.
 
-<Image src="/img/hub/emergency_access_vault_list_change_council_approve_dialog.png" alt="Emergency Access Vault List Approve Dialog" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_change_council_approve_dialog.png" alt="Emergency Access Vault List Approve Dialog" width="2880" height="1800" />
 
 After submitting your share, the button shows `Waiting for other approvals`. You can track the ongoing process progress in the same process button and its details popover.
 
@@ -99,17 +95,17 @@ You can also inspect details before approving. Hover (or click) the segment ring
 * process council members
 * per-member status (`Added` / `Pending`)
 
-<Image src="/img/hub/emergency_access_vault_list_hover_process.png" alt="Emergency Access Vault List Hover Process" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_hover_process.png" alt="Emergency Access Vault List Hover Process" width="2880" height="1800" />
 
-## Complete a Recovery Process
+## Complete a Recovery Process {/* #complete-a-recovery-process */}
 
 As soon as enough shares are available, the process button in the `Emergency Access` vault list shows `Complete now`.
 
-<Image src="/img/hub/emergency_access_vault_list_change_council_complete_now.png" alt="Emergency Access Vault List Complete Now" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_change_council_complete_now.png" alt="Emergency Access Vault List Complete Now" width="2880" height="1800" />
 
 Click `Complete now` to open the `Complete Emergency Access` dialog. In this dialog, review the process details and click `Complete Process` to finalize the recovery process.
 
-<Image src="/img/hub/emergency_access_vault_list_change_council_complete_dialog.png" alt="Emergency Access Vault List Complete Dialog" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_change_council_complete_dialog.png" alt="Emergency Access Vault List Complete Dialog" width="2880" height="1800" />
 
 Results by type:
 
@@ -118,14 +114,14 @@ Results by type:
 
 After successful completion, the process is removed.
 
-## Abort a Recovery Process
+## Abort a Recovery Process {/* #abort-a-recovery-process */}
 
 Running processes can be canceled in the dialog using `Abort this Process`.
 
-<Image src="/img/hub/emergency_access_vault_list_change_council_abort_dialog.png" alt="Emergency Access Vault List Abort Dialog" width="2560" height="1080" />
+<Image src="/img/hub/emergency_access_vault_list_change_council_abort_dialog.png" alt="Emergency Access Vault List Abort Dialog" width="2880" height="1800" />
 
 
-## Typical States and Notes
+## Typical States and Notes {/* #typical-states-and-notes */}
 
 The following warning states can appear in the Emergency Access list:
 
@@ -136,6 +132,6 @@ The following warning states can appear in the Emergency Access list:
 * `No Redundancy`: No fault tolerance in the council.
   What to do: Increase the number of council members or reduce the required threshold so one unavailable user does not block recovery.
 
-## Audit Log Events
+## Audit Log Events {/* #audit-log-events */}
 
 See [Emergency Access Audit Log events](admin.mdx#event-type-emergency-access).

docs/hub/guides/_category_.json

@@ -0,0 +1,8 @@
+{
+  "label": "Guides",
+  "position": 3,
+  "link": {
+    "type": "doc",
+    "id": "hub/guides/index"
+  }
+}

docs/hub/guides/admin-guide.mdx

@@ -0,0 +1,96 @@
+---
+id: admin-guide
+title: Admin Guide
+sidebar_position: 2
+description: Your first day as a Hub administrator — add users and groups, connect your identity provider, enable Emergency Access, and keep an eye on audit logs and license seats.
+---
+
+# Admin Guide
+
+This guide walks you through setting up a fresh Cryptomator Hub instance for your organization in about **20 minutes**.
+
+As a worked example, meet Alice: she administers Hub at the design agency Acme.
+Her instance is up and running, and now she adds her first users and a group, connects the company's identity provider, enables Emergency Access, and checks the audit log and license.
+
+## Before You Start {/* #before-you-start */}
+
+You need:
+
+* A running Hub instance — a local test instance from the [Quick Start](../quick-start.mdx) or a server deployment (managed or selfhosted)
+* An account with the `admin` [role](../user-group-management.mdx#roles), such as the initial admin account created during deployment.
+
+:::tip
+Not keen on hosting an instance yourself? Cryptomator Hub is also available as a [managed service](https://cryptomator.org/hub/managed/?utm_source=docs.cryptomator.org&utm_medium=referral&utm_campaign=admin-guide) with a free 30-day trial period — this guide applies there all the same.
+:::
+
+## Add Users and Groups {/* #add-users-and-groups */}
+
+Since version 2.0, users and groups are managed directly in Hub, via the `Users` and `Groups` entries in the sidebar.
+Alice creates accounts for Bob and Carol, each with username, email, and an initial password.
+She then creates the group *Designers* and adds both as members — sharing vaults with a group scales better than managing individual permissions.
+
+<Image src="/img/hub/user-create.png" alt="Create user form" width="2240" height="2064" />
+
+Bob and Carol can now log in and complete their account setup, as described in the [User Guide](user-guide.mdx#set-up-your-account).
+
+For more details, read [Create User](../user-group-management.mdx#create-user), [Create Group](../user-group-management.mdx#create-group), and [Manage Group Members](../user-group-management.mdx#manage-group-members).
+
+## Connect Your Identity Provider {/* #connect-your-identity-provider */}
+
+Creating users by hand is fine for a handful of people.
+Since Acme already manages its staff in a central directory, Alice instead connects Hub's bundled Keycloak to it, so users log in with their existing credentials and accounts stay in sync.
+
+<Image src="/img/hub/access-keycloak-link.png" alt="Accessing Keycloak via Hub" width="2880" height="1520" />
+
+The `Manage Keycloak` link takes Alice to the Keycloak admin console, where identity providers are configured on the `Identity providers` page:
+
+<Image src="/img/hub/keycloak-identity-providers.png" alt="Identity providers in the Keycloak admin console" width="2880" height="1800" />
+
+Depending on what your organization runs, follow the matching reference section:
+
+* [OpenID Connect](../keycloak.mdx#openid-connect) providers such as Microsoft Entra ID or Google Workspace.
+* [LDAP and Active Directory](../keycloak.mdx#ldap-and-active-directory) for user federation.
+* [Mapping groups to roles](../keycloak.mdx#mapping-groups-to-roles), e.g. to grant an *IT* directory group the `admin` role automatically.
+
+For more details, read [Connecting an External Identity Provider](../keycloak.mdx#connecting-an-external-identity-provider) and [External Identity Management](../user-group-management.mdx#enterprise-external-iam).
+
+## Enable Emergency Access {/* #enable-emergency-access */}
+
+What if Bob leaves Acme and the *Client Projects* vault has no other owner?
+Emergency Access, new in version 2.0, lets a council of trusted users jointly restore access to a vault.
+Alice enables it in the admin area and defines a default council, so every new vault gets Emergency Access conditions during creation.
+For existing vaults, owners set up the council in the vault details.
+
+<Image src="/img/hub/admin-emergency-access.png" alt="Emergency Access" width="2880" height="1800" />
+
+:::info[Enterprise Feature]
+Emergency Access is available as an Enterprise feature.
+Visit [cryptomator.org](https://cryptomator.org/hub/) for more information.
+:::
+
+For more details, read [Emergency Access admin settings](../admin.mdx#emergency-access), [Set Up Emergency Access](../emergency-access.mdx#set-up-emergency-access), and the per-vault [Emergency Access Council](../vault-management.mdx#emergency-access-council).
+
+## Review the Audit Log {/* #review-the-audit-log */}
+
+The next morning, Alice verifies that everything went as intended.
+In the audit log, she filters for vault events and sees the creation of *Client Projects* and the access grants for Carol and the *Designers* group, each with actor and timestamp.
+
+<Image src="/img/hub/auditlogs-overview.png" alt="Audit Logs Table View" width="2880" height="1720" />
+
+For more details, read [Audit Logs](../admin.mdx#audit-logs), [Filtering Audit Logs](../admin.mdx#filtering-audit-logs), and the list of [Event Types](../admin.mdx#event-types).
+
+## Check Your License {/* #check-your-license */}
+
+Finally, Alice opens the license section of the admin area.
+With Bob and Carol having vault access, two seats are in use — a seat is occupied by every user who is assigned to at least one vault.
+The overview shows the used and licensed seats and where to upgrade before the team grows.
+
+<Image src="/img/hub/admin-area-license.png" alt="Administration area" width="2880" height="1800" />
+
+For more details, read [License](../admin.mdx#license), [What Is a Seat?](../admin.mdx#what-is-a-seat), and [Updating Your License](../admin.mdx#updating-your-license).
+
+## Next Steps {/* #next-steps */}
+
+* Set up [backups](../operations.mdx#backup) before real data accumulates.
+* Harden logins with [session timeouts](../keycloak.mdx#session-timeouts) and [access restrictions](../keycloak.mdx#restricting-access-to-hub).
+* Send your team the [User Guide](user-guide.mdx) so they can get started on their own.

docs/hub/guides/index.mdx

@@ -0,0 +1,8 @@
+import DocCardList from '@theme/DocCardList';
+
+# Guides
+
+Step-by-step walkthroughs for the most common Cryptomator Hub workflows.
+Each guide follows a worked example from start to finish and links to the reference pages for details.
+
+<DocCardList />