# Pocket-ID — OIDC Identity Provider

**CT 110 "id"** · `192.168.1.5:11000` · `https://id.nuclide.systems`  
Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).

## What it does

Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation.

## Admin access

- URL: `https://id.nuclide.systems` (admin panel is the default view when logged in as admin)
- Admin user: `fkrebs@nucli.de`
- No API endpoint for client management — use the web UI.

## OIDC endpoints (standard discovery)

| Endpoint | URL |
|---|---|
| Discovery | `https://id.nuclide.systems/.well-known/openid-configuration` |
| Authorization | `https://id.nuclide.systems/authorize` |
| Token | `https://id.nuclide.systems/api/oidc/token` |
| Userinfo | `https://id.nuclide.systems/api/oidc/userinfo` |
| JWKS | `https://id.nuclide.systems/api/oidc/jwks` |

## Creating a new OIDC client

1. Go to `https://id.nuclide.systems` → **OIDC Clients** → **New Client**
2. Fill in:
   - **Name**: descriptive (e.g. "Homarr", "Grafana")
   - **Redirect URIs**: the callback URL the service expects (see per-service table below)
   - **PKCE**: enable if the service supports it (preferred)
3. Copy the **Client ID** and **Client Secret** — secret is shown once.
4. Paste into the service's env vars (see patterns below).

> Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view.

## Current clients

| Service | CT | Redirect URI | Notes |
|---|---|---|---|
| Gitea | 111 | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled |
| Coder | 111 | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled |
| Arcane | 104 | `https://arcane.nuclide.systems/auth/callback` | OIDC_CLIENT_SECRET rotated 2026-05-22 |
| n8n | 104 | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 |
| Vaultwarden | 104 | `https://vault.nuclide.systems/identity/connect/token` | client created 2026-05-21; auth flow not yet wired |
| Homarr | 109 | `http://192.168.1.8:7575/api/auth/callback/oidc` | SSO active 2026-05-23; client `63a94e30` |
| Grafana | 109 | `http://192.168.1.8:3000/login/generic_oauth` | SSO active 2026-05-23; client `92d987d5`; PKCE enabled |

## Env var patterns per service type

### Homarr (v1 homarr-labs)

```env
AUTH_PROVIDERS=credentials,oidc   # plural; comma-separated list. Singular AUTH_PROVIDER is ignored.
AUTH_OIDC_ISSUER=https://id.nuclide.systems
AUTH_OIDC_CLIENT_ID=<client-id>
AUTH_OIDC_CLIENT_SECRET=<client-secret>
AUTH_OIDC_SCOPE=openid profile email
AUTH_OIDC_NAME=Pocket-ID
```

### Grafana

```env
GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<client-id>
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client-secret>
GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token
GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo
GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout
GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer'
```

### Gitea

```ini
[oauth2]
ENABLED = true

[service]
ENABLE_PASSWORD_SIGNIN_FORM = false
```
Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect.

### Coder

```env
CODER_OIDC_ISSUER_URL=https://id.nuclide.systems
CODER_OIDC_CLIENT_ID=<client-id>
CODER_OIDC_CLIENT_SECRET=<client-secret>
CODER_OIDC_SCOPES=openid,profile,email
CODER_DISABLE_PASSWORD_AUTH=true
```

### Generic (any service with standard OIDC)

```
Issuer:        https://id.nuclide.systems
Auth URL:      https://id.nuclide.systems/authorize
Token URL:     https://id.nuclide.systems/api/oidc/token
Userinfo URL:  https://id.nuclide.systems/api/oidc/userinfo
JWKS URL:      https://id.nuclide.systems/api/oidc/jwks
Scopes:        openid profile email
```

## Backup

Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs `pocket-id export` inside the container, copies the ZIP + signing keys to UNAS staging path, then the `services-backup-plan` snapshots to JottaCloud. See `services/backrest.md`.

## Stack location

CT 110 (`192.168.1.5`): `/opt/stacks/pocketid/docker-compose.yml`

```yaml
# key env vars
POCKET_ID_URL=https://id.nuclide.systems
TRUST_PROXY=true
MAXMIND_LICENSE_KEY=...  # optional geo-IP
```