fkrebs
4c97732720
Client IDs created programmatically via Pocket-ID /api/oidc/clients endpoint. Env vars injected into both compose files and force-recreated. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
4.7 KiB
Pocket-ID — OIDC Identity Provider
CT 110 "id" · 192.168.1.5:11000 · https://id.nuclide.systems
Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).
What it does
Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation.
Admin access
- URL:
https://id.nuclide.systems(admin panel is the default view when logged in as admin) - Admin user:
fkrebs@nucli.de - No API endpoint for client management — use the web UI.
OIDC endpoints (standard discovery)
| Endpoint | URL |
|---|---|
| Discovery | https://id.nuclide.systems/.well-known/openid-configuration |
| Authorization | https://id.nuclide.systems/authorize |
| Token | https://id.nuclide.systems/api/oidc/token |
| Userinfo | https://id.nuclide.systems/api/oidc/userinfo |
| JWKS | https://id.nuclide.systems/api/oidc/jwks |
Creating a new OIDC client
- Go to
https://id.nuclide.systems→ OIDC Clients → New Client - Fill in:
- Name: descriptive (e.g. "Homarr", "Grafana")
- Redirect URIs: the callback URL the service expects (see per-service table below)
- PKCE: enable if the service supports it (preferred)
- Copy the Client ID and Client Secret — secret is shown once.
- Paste into the service's env vars (see patterns below).
Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view.
Current clients
| Service | CT | Redirect URI | Notes |
|---|---|---|---|
| Gitea | 111 | https://git.nuclide.systems/user/oauth2/pocket-id/callback |
SSO active; local password sign-in disabled |
| Coder | 111 | https://dev.nuclide.systems/api/v2/users/oidc/callback |
SSO active; password auth disabled |
| Arcane | 104 | https://arcane.nuclide.systems/auth/callback |
OIDC_CLIENT_SECRET rotated 2026-05-22 |
| n8n | 104 | https://n8n.nuclide.systems/rest/oauth2-credential/callback |
encryption key rotated 2026-05-22 |
| Vaultwarden | 104 | https://vault.nuclide.systems/identity/connect/token |
client created 2026-05-21; auth flow not yet wired |
| Homarr | 109 | http://192.168.1.8:7575/api/auth/callback/oidc |
SSO active 2026-05-23; client 63a94e30 |
| Grafana | 109 | http://192.168.1.8:3000/login/generic_oauth |
SSO active 2026-05-23; client 92d987d5; PKCE enabled |
Env var patterns per service type
Homarr (v1 homarr-labs)
AUTH_PROVIDER=oidc
AUTH_OIDC_ISSUER=https://id.nuclide.systems
AUTH_OIDC_CLIENT_ID=<client-id>
AUTH_OIDC_CLIENT_SECRET=<client-secret>
AUTH_OIDC_SCOPE=openid profile email
AUTH_OIDC_NAME=Pocket-ID
Grafana
GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<client-id>
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client-secret>
GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token
GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo
GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout
GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer'
Gitea
[oauth2]
ENABLED = true
[service]
ENABLE_PASSWORD_SIGNIN_FORM = false
Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect.
Coder
CODER_OIDC_ISSUER_URL=https://id.nuclide.systems
CODER_OIDC_CLIENT_ID=<client-id>
CODER_OIDC_CLIENT_SECRET=<client-secret>
CODER_OIDC_SCOPES=openid,profile,email
CODER_DISABLE_PASSWORD_AUTH=true
Generic (any service with standard OIDC)
Issuer: https://id.nuclide.systems
Auth URL: https://id.nuclide.systems/authorize
Token URL: https://id.nuclide.systems/api/oidc/token
Userinfo URL: https://id.nuclide.systems/api/oidc/userinfo
JWKS URL: https://id.nuclide.systems/api/oidc/jwks
Scopes: openid profile email
Backup
Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs pocket-id export inside the container, copies the ZIP + signing keys to UNAS staging path, then the services-backup-plan snapshots to JottaCloud. See services/backrest.md.
Stack location
CT 110 (192.168.1.5): /opt/stacks/pocketid/docker-compose.yml
# key env vars
POCKET_ID_URL=https://id.nuclide.systems
TRUST_PROXY=true
MAXMIND_LICENSE_KEY=... # optional geo-IP