fkrebs
13bc1ecc12
RESUME: - Backrest 3-for-3 success on 2026-05-26 (video-projects-plan recovered) - Vault dedup + 234 link rewrites + cleanup - Plugin audit + Memos Sync + Obsidian Git + streamlined-ui - Config-to-git fleet now 8 repos - AdGuard *.nuclide.lan zone (30 A-records) - 3 new Homarr boards (home/admin/command) - Pocket-ID LAN callback URLs - Immich HTTP/2 Keep-Alive diagnosed - New constraints: use LAN aliases; daily-note merge policy pocket-id.md: LAN callback URLs added for Homarr/Grafana/Infisical/Proxmox. Filed earlier as part of 2026-05-24 work, committing now.
5.2 KiB
5.2 KiB
Pocket-ID — OIDC Identity Provider
CT 110 "id" · 192.168.1.5:11000 · https://id.nuclide.systems
Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).
What it does
Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation.
Admin access
- URL:
https://id.nuclide.systems(admin panel is the default view when logged in as admin) - Admin user:
fkrebs@nucli.de - No API endpoint for client management — use the web UI.
OIDC endpoints (standard discovery)
| Endpoint | URL |
|---|---|
| Discovery | https://id.nuclide.systems/.well-known/openid-configuration |
| Authorization | https://id.nuclide.systems/authorize |
| Token | https://id.nuclide.systems/api/oidc/token |
| Userinfo | https://id.nuclide.systems/api/oidc/userinfo |
| JWKS | https://id.nuclide.systems/api/oidc/jwks |
Creating a new OIDC client
- Go to
https://id.nuclide.systems→ OIDC Clients → New Client - Fill in:
- Name: descriptive (e.g. "Homarr", "Grafana")
- Redirect URIs: the callback URL the service expects (see per-service table below)
- PKCE: enable if the service supports it (preferred)
- Copy the Client ID and Client Secret — secret is shown once.
- Paste into the service's env vars (see patterns below).
Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view.
Current clients
| Service | CT | Redirect URI | Notes |
|---|---|---|---|
| Gitea | 111 | https://git.nuclide.systems/user/oauth2/pocket-id/callback |
SSO active; local password sign-in disabled |
| Coder | 111 | https://dev.nuclide.systems/api/v2/users/oidc/callback |
SSO active; password auth disabled |
| Arcane | 104 | https://arcane.nuclide.systems/auth/callback |
OIDC_CLIENT_SECRET rotated 2026-05-22 |
| n8n | 104 | https://n8n.nuclide.systems/rest/oauth2-credential/callback |
encryption key rotated 2026-05-22 |
| Vaultwarden | 104 | https://vault.nuclide.systems/identity/connect/token |
client created 2026-05-21; auth flow not yet wired |
| Homarr | 109 | http://192.168.1.8:7575/api/auth/callback/oidc + http://homarr.nuclide.lan:7575/... |
SSO active 2026-05-23; client 63a94e30; LAN alias added 2026-05-24 |
| Grafana | 109 | http://192.168.1.8:3000/login/generic_oauth + http://grafana.nuclide.lan:3000/... |
SSO active 2026-05-23; client 92d987d5; PKCE enabled; LAN alias added 2026-05-24 |
| Infisical | 112 | http://192.168.1.7:8200/api/v1/sso/oidc/callback + http://secrets.nuclide.lan:8200/... |
LAN alias added 2026-05-24; manual OIDC config still pending |
| Proxmox VE | host | https://192.168.1.20:8006 + https://pve.nuclide.lan:8006 |
LAN alias added 2026-05-24 |
Env var patterns per service type
Homarr (v1 homarr-labs)
AUTH_PROVIDERS=credentials,oidc # plural; comma-separated list. Singular AUTH_PROVIDER is ignored.
AUTH_OIDC_ISSUER=https://id.nuclide.systems
AUTH_OIDC_CLIENT_ID=<client-id>
AUTH_OIDC_CLIENT_SECRET=<client-secret>
AUTH_OIDC_SCOPE=openid profile email
AUTH_OIDC_NAME=Pocket-ID
Grafana
GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<client-id>
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client-secret>
GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token
GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo
GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout
GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer'
Gitea
[oauth2]
ENABLED = true
[service]
ENABLE_PASSWORD_SIGNIN_FORM = false
Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect.
Coder
CODER_OIDC_ISSUER_URL=https://id.nuclide.systems
CODER_OIDC_CLIENT_ID=<client-id>
CODER_OIDC_CLIENT_SECRET=<client-secret>
CODER_OIDC_SCOPES=openid,profile,email
CODER_DISABLE_PASSWORD_AUTH=true
Generic (any service with standard OIDC)
Issuer: https://id.nuclide.systems
Auth URL: https://id.nuclide.systems/authorize
Token URL: https://id.nuclide.systems/api/oidc/token
Userinfo URL: https://id.nuclide.systems/api/oidc/userinfo
JWKS URL: https://id.nuclide.systems/api/oidc/jwks
Scopes: openid profile email
Backup
Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs pocket-id export inside the container, copies the ZIP + signing keys to UNAS staging path, then the services-backup-plan snapshots to JottaCloud. See services/backrest.md.
Stack location
CT 110 (192.168.1.5): /opt/stacks/pocketid/docker-compose.yml
# key env vars
POCKET_ID_URL=https://id.nuclide.systems
TRUST_PROXY=true
MAXMIND_LICENSE_KEY=... # optional geo-IP