fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f65ceef90a499d794836bb17464e5a938f34f034
docs/services/pocket-id.md
T
fkrebs 13bc1ecc12 RESUME + pocket-id: reflect 2026-05-24 → 26 state 
RESUME:
- Backrest 3-for-3 success on 2026-05-26 (video-projects-plan recovered)
- Vault dedup + 234 link rewrites + cleanup
- Plugin audit + Memos Sync + Obsidian Git + streamlined-ui
- Config-to-git fleet now 8 repos
- AdGuard *.nuclide.lan zone (30 A-records)
- 3 new Homarr boards (home/admin/command)
- Pocket-ID LAN callback URLs
- Immich HTTP/2 Keep-Alive diagnosed
- New constraints: use LAN aliases; daily-note merge policy

pocket-id.md: LAN callback URLs added for Homarr/Grafana/Infisical/Proxmox.
Filed earlier as part of 2026-05-24 work, committing now.
2026-05-26 06:03:28 +02:00

128 lines
5.2 KiB
Markdown
Raw Blame History

# Pocket-ID — OIDC Identity Provider
**CT 110 "id"** · `192.168.1.5:11000` · `https://id.nuclide.systems`
Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).
## What it does
Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation.
## Admin access
- URL: `https://id.nuclide.systems` (admin panel is the default view when logged in as admin)
- Admin user: `fkrebs@nucli.de`
- No API endpoint for client management — use the web UI.
## OIDC endpoints (standard discovery)
| Endpoint | URL |
|---|---|
| Discovery | `https://id.nuclide.systems/.well-known/openid-configuration` |
| Authorization | `https://id.nuclide.systems/authorize` |
| Token | `https://id.nuclide.systems/api/oidc/token` |
| Userinfo | `https://id.nuclide.systems/api/oidc/userinfo` |
| JWKS | `https://id.nuclide.systems/api/oidc/jwks` |
## Creating a new OIDC client
1. Go to `https://id.nuclide.systems` → **OIDC Clients** → **New Client**
2. Fill in:
- **Name**: descriptive (e.g. "Homarr", "Grafana")
- **Redirect URIs**: the callback URL the service expects (see per-service table below)
- **PKCE**: enable if the service supports it (preferred)
3. Copy the **Client ID** and **Client Secret** — secret is shown once.
4. Paste into the service's env vars (see patterns below).
> Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view.
## Current clients
| Service | CT | Redirect URI | Notes |
|---|---|---|---|
| Gitea | 111 | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled |
| Coder | 111 | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled |
| Arcane | 104 | `https://arcane.nuclide.systems/auth/callback` | OIDC_CLIENT_SECRET rotated 2026-05-22 |
| n8n | 104 | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 |
| Vaultwarden | 104 | `https://vault.nuclide.systems/identity/connect/token` | client created 2026-05-21; auth flow not yet wired |
| Homarr | 109 | `http://192.168.1.8:7575/api/auth/callback/oidc` + `http://homarr.nuclide.lan:7575/...` | SSO active 2026-05-23; client `63a94e30`; LAN alias added 2026-05-24 |
| Grafana | 109 | `http://192.168.1.8:3000/login/generic_oauth` + `http://grafana.nuclide.lan:3000/...` | SSO active 2026-05-23; client `92d987d5`; PKCE enabled; LAN alias added 2026-05-24 |
| Infisical | 112 | `http://192.168.1.7:8200/api/v1/sso/oidc/callback` + `http://secrets.nuclide.lan:8200/...` | LAN alias added 2026-05-24; manual OIDC config still pending |
| Proxmox VE | host | `https://192.168.1.20:8006` + `https://pve.nuclide.lan:8006` | LAN alias added 2026-05-24 |
## Env var patterns per service type
### Homarr (v1 homarr-labs)
```env
AUTH_PROVIDERS=credentials,oidc # plural; comma-separated list. Singular AUTH_PROVIDER is ignored.
AUTH_OIDC_ISSUER=https://id.nuclide.systems
AUTH_OIDC_CLIENT_ID=<client-id>
AUTH_OIDC_CLIENT_SECRET=<client-secret>
AUTH_OIDC_SCOPE=openid profile email
AUTH_OIDC_NAME=Pocket-ID
```
### Grafana
```env
GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<client-id>
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client-secret>
GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token
GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo
GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout
GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer'
```
### Gitea
```ini
[oauth2]
ENABLED = true
[service]
ENABLE_PASSWORD_SIGNIN_FORM = false
```
Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect.
### Coder
```env
CODER_OIDC_ISSUER_URL=https://id.nuclide.systems
CODER_OIDC_CLIENT_ID=<client-id>
CODER_OIDC_CLIENT_SECRET=<client-secret>
CODER_OIDC_SCOPES=openid,profile,email
CODER_DISABLE_PASSWORD_AUTH=true
```
### Generic (any service with standard OIDC)
```
Issuer: https://id.nuclide.systems
Auth URL: https://id.nuclide.systems/authorize
Token URL: https://id.nuclide.systems/api/oidc/token
Userinfo URL: https://id.nuclide.systems/api/oidc/userinfo
JWKS URL: https://id.nuclide.systems/api/oidc/jwks
Scopes: openid profile email
```
## Backup
Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs `pocket-id export` inside the container, copies the ZIP + signing keys to UNAS staging path, then the `services-backup-plan` snapshots to JottaCloud. See `services/backrest.md`.
## Stack location
CT 110 (`192.168.1.5`): `/opt/stacks/pocketid/docker-compose.yml`
```yaml
# key env vars
POCKET_ID_URL=https://id.nuclide.systems
TRUST_PROXY=true
MAXMIND_LICENSE_KEY=... # optional geo-IP
```
Reference in New Issue View Git Blame Copy Permalink