From 03fd23b37bf2c9b9bc81c918cba05f5d1058b933 Mon Sep 17 00:00:00 2001 From: "fkrebs (via Claude)" Date: Tue, 26 May 2026 21:08:51 +0200 Subject: [PATCH] Update pocket-id.md: full client table with IDs, API key, remove Arcane/lobehub --- services/pocket-id.md | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/services/pocket-id.md b/services/pocket-id.md index 3ce8731..3c5688a 100644 --- a/services/pocket-id.md +++ b/services/pocket-id.md @@ -11,7 +11,7 @@ Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports - URL: `https://id.nuclide.systems` (admin panel is the default view when logged in as admin) - Admin user: `fkrebs@nucli.de` -- No API endpoint for client management — use the web UI. +- API key: `1ed1d53a2c1b3fcbafea46863b0b9e88a649422b67541c764481c03918b60bc6` — header `X-API-Key` (not Bearer); stored as SHA-256 hash in SQLite `api_keys` table on CT 105 ## OIDC endpoints (standard discovery) @@ -37,17 +37,27 @@ Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports ## Current clients -| Service | CT | Redirect URI | Notes | -|---|---|---|---| -| Gitea | 111 | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled | -| Coder | 111 | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled | -| Arcane | 104 | `https://arcane.nuclide.systems/auth/callback` | OIDC_CLIENT_SECRET rotated 2026-05-22 | -| n8n | 104 | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 | -| Vaultwarden | 104 | `https://vault.nuclide.systems/identity/connect/token` | client created 2026-05-21; auth flow not yet wired | -| Homarr | 109 | `http://192.168.1.8:7575/api/auth/callback/oidc` + `http://homarr.nuclide.lan:7575/...` | SSO active 2026-05-23; client `63a94e30`; LAN alias added 2026-05-24 | -| Grafana | 109 | `http://192.168.1.8:3000/login/generic_oauth` + `http://grafana.nuclide.lan:3000/...` | SSO active 2026-05-23; client `92d987d5`; PKCE enabled; LAN alias added 2026-05-24 | -| Infisical | 112 | `http://192.168.1.7:8200/api/v1/sso/oidc/callback` + `http://secrets.nuclide.lan:8200/...` | LAN alias added 2026-05-24; manual OIDC config still pending | -| Proxmox VE | host | `https://192.168.1.20:8006` + `https://pve.nuclide.lan:8006` | LAN alias added 2026-05-24 | +| Service | CT | Client ID | Redirect URI | Notes | +|---|---|---|---|---| +| Gitea | 111 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled | +| Coder | 111 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled | +| n8n | 104 | `33135ad4-a3ed-45d3-938f-639abd2b9663` | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 | +| Vaultwarden | 104 | `7cda8d60-9bfa-44ca-ae9b-8ae436024a8b` | `https://vault.nuclide.systems/identity/connect/token` | created 2026-05-21; auth flow not yet wired | +| Homarr | 109 | `63a94e30-7bbf-4511-9a4c-82d992633427` | `http://192.168.1.8:7575/api/auth/callback/oidc` | SSO active 2026-05-23; LAN alias added 2026-05-24 | +| Grafana | 109 | `92d987d5-d066-4e19-8fa1-960114c1244c` | `http://192.168.1.8:3000/login/generic_oauth` | SSO active 2026-05-23; PKCE enabled; LAN alias added 2026-05-24 | +| Infisical | 112 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.7:8200/api/v1/sso/oidc/callback` | LAN alias added 2026-05-24; manual OIDC config still pending | +| Proxmox VE | host | `38469e7e-1fff-4841-83a9-74bf38d847eb` | `https://192.168.1.20:8006` | LAN alias added 2026-05-24 | +| Nextcloud | 105 | `a14b8076-985c-4989-95f8-e0283bfbdf32` | `https://nc.nuclide.systems/apps/oidc_login/oidc` | | +| Immich | 104 | `9c91c18b-e009-4371-9c54-b71d54e3c77a` | `https://photos.nuclide.systems/auth/login` | | +| Karakeep | 104 | `d92f82b0-b876-48c2-b3b0-05dd35fdf908` | `https://bookmarks.nuclide.systems/api/auth/callback/custom-server` | | +| Audiobookshelf | 104 | `cbbf20d5-d15c-419c-8f18-82d2fd7e810f` | `https://abs.nuclide.systems/auth/openid/callback` | | +| Shelfarr | 104 | `d8733fcc-eee8-42c4-b976-cb14e4e87693` | `https://shelfarr.nuclide.systems/auth/callback` | | +| Memos | 104 | `62bf4e0d-f0fe-4453-b0da-59eeea2bb69d` | `https://memos.nuclide.systems/auth/callback` | | +| Open WebUI | 104 | `e41534ae-994a-4188-8d42-31690c354284` | `https://chat.nuclide.systems/oauth/oidc/callback` | | +| Portainer | 109 | `bdf8b019-072e-4c21-b1fb-ad9c5ad392dc` | `http://192.168.1.8:9000/` | configured 2026-05-26; secret `DZu1JrzEpChU3Deeh0ycaV29s5aBQLGR` | +| Bifrost MCP | 104 | `ec0d15e6-e86d-49b0-ac12-cdfb5afc9086` | `https://ai.nuclide.systems` | per_user_oauth (not currently active — all MCP clients use auth_type=none) | +| mcp-auth | 104 | `af2f837b-8a77-4f6f-80b0-71b734eb7b0b` | — | internal; no launch URL | +| nuc-ai | 104 | `82ca2d53-6df4-4671-875c-fee85b54b76f` | — | internal; no launch URL | ## Env var patterns per service type