# Pocket-ID — OIDC Identity Provider **CT 109 "ops"** · `192.168.1.8:11000` · `https://id.nuclide.systems` Migrated CT 104 → CT 110 on 2026-05-20; CT 110 → CT 109 on 2026-05-26. SQLite-only (no Postgres). Compose at `/opt/stacks/pocketid/` on CT 109. ## What it does Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation. ## Admin access - URL: `https://id.nuclide.systems` (admin panel is the default view when logged in as admin) - Admin user: `fkrebs@nucli.de` - API key: `1ed1d53a2c1b3fcbafea46863b0b9e88a649422b67541c764481c03918b60bc6` — header `X-API-Key` (not Bearer); stored as SHA-256 hash in SQLite `api_keys` table on CT 105 ## OIDC endpoints (standard discovery) | Endpoint | URL | |---|---| | Discovery | `https://id.nuclide.systems/.well-known/openid-configuration` | | Authorization | `https://id.nuclide.systems/authorize` | | Token | `https://id.nuclide.systems/api/oidc/token` | | Userinfo | `https://id.nuclide.systems/api/oidc/userinfo` | | JWKS | `https://id.nuclide.systems/api/oidc/jwks` | ## Creating a new OIDC client 1. Go to `https://id.nuclide.systems` → **OIDC Clients** → **New Client** 2. Fill in: - **Name**: descriptive (e.g. "Homarr", "Grafana") - **Redirect URIs**: the callback URL the service expects (see per-service table below) - **PKCE**: enable if the service supports it (preferred) 3. Copy the **Client ID** and **Client Secret** — secret is shown once. 4. Paste into the service's env vars (see patterns below). > Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view. ## Current clients | Service | CT | Client ID | Redirect URI | Notes | |---|---|---|---|---| | Gitea | 104 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled | | Coder | 104 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled | | n8n | 104 | `33135ad4-a3ed-45d3-938f-639abd2b9663` | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 | | Vaultwarden | 104 | `7cda8d60-9bfa-44ca-ae9b-8ae436024a8b` | `https://vault.nuclide.systems/identity/connect/token` | created 2026-05-21; auth flow not yet wired | | ~~Homarr~~ | ~~109~~ | ~~`63a94e30-7bbf-4511-9a4c-82d992633427`~~ | — | **DECOMMISSIONED** — replaced by Homepage | | Grafana | 109 | `92d987d5-d066-4e19-8fa1-960114c1244c` | `http://192.168.1.8:3000/login/generic_oauth` | SSO active 2026-05-23; PKCE enabled; LAN alias added 2026-05-24 | | Infisical | 109 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.8:8200/api/v1/sso/oidc/callback` | migrated CT112→CT109 2026-05-26; manual OIDC config still pending | | Proxmox VE | host | `38469e7e-1fff-4841-83a9-74bf38d847eb` | `https://192.168.1.20:8006` | LAN alias added 2026-05-24 | | Nextcloud | 105 | `a14b8076-985c-4989-95f8-e0283bfbdf32` | `https://nc.nuclide.systems/apps/oidc_login/oidc` | | | Immich | 104 | `9c91c18b-e009-4371-9c54-b71d54e3c77a` | `https://photos.nuclide.systems/auth/login` | | | Karakeep | 104 | `d92f82b0-b876-48c2-b3b0-05dd35fdf908` | `https://bookmarks.nuclide.systems/api/auth/callback/custom-server` | | | Audiobookshelf | 104 | `cbbf20d5-d15c-419c-8f18-82d2fd7e810f` | `https://abs.nuclide.systems/auth/openid/callback` | | | Shelfarr | 104 | `d8733fcc-eee8-42c4-b976-cb14e4e87693` | `https://shelfarr.nuclide.systems/auth/callback` | | | Memos | 104 | `62bf4e0d-f0fe-4453-b0da-59eeea2bb69d` | `https://memos.nuclide.systems/auth/callback` | | | Open WebUI | 104 | `e41534ae-994a-4188-8d42-31690c354284` | `https://chat.nuclide.systems/oauth/oidc/callback` | | | Portainer | 109 | `bdf8b019-072e-4c21-b1fb-ad9c5ad392dc` | `http://192.168.1.8:9000/` | configured 2026-05-26; secret `DZu1JrzEpChU3Deeh0ycaV29s5aBQLGR` | | Bifrost MCP | 104 | `ec0d15e6-e86d-49b0-ac12-cdfb5afc9086` | `https://ai.nuclide.systems` | per_user_oauth (not currently active — all MCP clients use auth_type=none) | | mcp-auth | 104 | `af2f837b-8a77-4f6f-80b0-71b734eb7b0b` | — | internal; no launch URL | | nuc-ai | 104 | `82ca2d53-6df4-4671-875c-fee85b54b76f` | — | internal; no launch URL | | Miniflux | 104 | `7092cd25-6174-4bae-b587-1e8c80c38795` | `https://flux.nuclide.systems/oauth2/oidc/callback` | RSS reader; OIDC auto-creates user; admin = fkrebs | ## Env var patterns per service type ### Homarr (v1 homarr-labs) ```env AUTH_PROVIDERS=credentials,oidc # plural; comma-separated list. Singular AUTH_PROVIDER is ignored. AUTH_OIDC_ISSUER=https://id.nuclide.systems AUTH_OIDC_CLIENT_ID= AUTH_OIDC_CLIENT_SECRET= AUTH_OIDC_SCOPE=openid profile email AUTH_OIDC_NAME=Pocket-ID ``` ### Grafana ```env GF_AUTH_GENERIC_OAUTH_ENABLED=true GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID GF_AUTH_GENERIC_OAUTH_CLIENT_ID= GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET= GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout GF_AUTH_GENERIC_OAUTH_USE_PKCE=true GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer' ``` ### Gitea ```ini [oauth2] ENABLED = true [service] ENABLE_PASSWORD_SIGNIN_FORM = false ``` Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect. ### Coder ```env CODER_OIDC_ISSUER_URL=https://id.nuclide.systems CODER_OIDC_CLIENT_ID= CODER_OIDC_CLIENT_SECRET= CODER_OIDC_SCOPES=openid,profile,email CODER_DISABLE_PASSWORD_AUTH=true ``` ### Generic (any service with standard OIDC) ``` Issuer: https://id.nuclide.systems Auth URL: https://id.nuclide.systems/authorize Token URL: https://id.nuclide.systems/api/oidc/token Userinfo URL: https://id.nuclide.systems/api/oidc/userinfo JWKS URL: https://id.nuclide.systems/api/oidc/jwks Scopes: openid profile email ``` ## Backup Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs `pocket-id export` inside the container, copies the ZIP + signing keys to UNAS staging path, then the `services-backup-plan` snapshots to JottaCloud. See `services/backrest.md`. ## Stack location CT 110 (`192.168.1.5`): `/opt/stacks/pocketid/docker-compose.yml` ```yaml # key env vars POCKET_ID_URL=https://id.nuclide.systems TRUST_PROXY=true MAXMIND_LICENSE_KEY=... # optional geo-IP ```