fkrebs
474af687af
- CHANGELOG: full 2026-05-23 backfill (Loki, Alloy×12 hosts, pve-exporter, HA prometheus integration, 5 dashboards, 3 alert rules, Homarr, homelab-configs repo) - services/pocket-id.md: new — OIDC endpoints, client creation walkthrough, per-service env var patterns, current client registry, backup notes - infra/proxmox-state.md: redact D-Link credentials from plaintext (pelican/pinkpanther) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
126 lines
4.7 KiB
Markdown
126 lines
4.7 KiB
Markdown
# Pocket-ID — OIDC Identity Provider
|
|
|
|
**CT 110 "id"** · `192.168.1.5:11000` · `https://id.nuclide.systems`
|
|
Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).
|
|
|
|
## What it does
|
|
|
|
Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports OIDC can delegate login to it — one account, one MFA setup, SSO across the homelab. Clients are managed via an admin UI; there is no API key / scripted client creation.
|
|
|
|
## Admin access
|
|
|
|
- URL: `https://id.nuclide.systems` (admin panel is the default view when logged in as admin)
|
|
- Admin user: `fkrebs@nucli.de`
|
|
- No API endpoint for client management — use the web UI.
|
|
|
|
## OIDC endpoints (standard discovery)
|
|
|
|
| Endpoint | URL |
|
|
|---|---|
|
|
| Discovery | `https://id.nuclide.systems/.well-known/openid-configuration` |
|
|
| Authorization | `https://id.nuclide.systems/authorize` |
|
|
| Token | `https://id.nuclide.systems/api/oidc/token` |
|
|
| Userinfo | `https://id.nuclide.systems/api/oidc/userinfo` |
|
|
| JWKS | `https://id.nuclide.systems/api/oidc/jwks` |
|
|
|
|
## Creating a new OIDC client
|
|
|
|
1. Go to `https://id.nuclide.systems` → **OIDC Clients** → **New Client**
|
|
2. Fill in:
|
|
- **Name**: descriptive (e.g. "Homarr", "Grafana")
|
|
- **Redirect URIs**: the callback URL the service expects (see per-service table below)
|
|
- **PKCE**: enable if the service supports it (preferred)
|
|
3. Copy the **Client ID** and **Client Secret** — secret is shown once.
|
|
4. Paste into the service's env vars (see patterns below).
|
|
|
|
> Pocket-ID 2.7.0+ stores secrets as bcrypt hashes — the plaintext secret is only visible at creation time. If lost, regenerate in the client edit view.
|
|
|
|
## Current clients
|
|
|
|
| Service | CT | Redirect URI | Notes |
|
|
|---|---|---|---|
|
|
| Gitea | 111 | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled |
|
|
| Coder | 111 | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled |
|
|
| Arcane | 104 | `https://arcane.nuclide.systems/auth/callback` | OIDC_CLIENT_SECRET rotated 2026-05-22 |
|
|
| n8n | 104 | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 |
|
|
| Vaultwarden | 104 | `https://vault.nuclide.systems/identity/connect/token` | client created 2026-05-21; auth flow not yet wired |
|
|
| Homarr | 109 | `http://192.168.1.8:7575/api/auth/callback/oidc` | **pending** — client not yet created |
|
|
| Grafana | 109 | `http://192.168.1.8:3000/login/generic_oauth` | **pending** — client not yet created |
|
|
|
|
## Env var patterns per service type
|
|
|
|
### Homarr (v1 homarr-labs)
|
|
|
|
```env
|
|
AUTH_PROVIDER=oidc
|
|
AUTH_OIDC_ISSUER=https://id.nuclide.systems
|
|
AUTH_OIDC_CLIENT_ID=<client-id>
|
|
AUTH_OIDC_CLIENT_SECRET=<client-secret>
|
|
AUTH_OIDC_SCOPE=openid profile email
|
|
AUTH_OIDC_NAME=Pocket-ID
|
|
```
|
|
|
|
### Grafana
|
|
|
|
```env
|
|
GF_AUTH_GENERIC_OAUTH_ENABLED=true
|
|
GF_AUTH_GENERIC_OAUTH_NAME=Pocket-ID
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<client-id>
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client-secret>
|
|
GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
|
|
GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://id.nuclide.systems/authorize
|
|
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://id.nuclide.systems/api/oidc/token
|
|
GF_AUTH_GENERIC_OAUTH_API_URL=https://id.nuclide.systems/api/oidc/userinfo
|
|
GF_AUTH_SIGNOUT_REDIRECT_URL=https://id.nuclide.systems/logout
|
|
GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
|
|
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN=false
|
|
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'admins') && 'Admin' || 'Viewer'
|
|
```
|
|
|
|
### Gitea
|
|
|
|
```ini
|
|
[oauth2]
|
|
ENABLED = true
|
|
|
|
[service]
|
|
ENABLE_PASSWORD_SIGNIN_FORM = false
|
|
```
|
|
Auth source added via Gitea admin UI → Authentication Sources → OAuth2 → OpenID Connect.
|
|
|
|
### Coder
|
|
|
|
```env
|
|
CODER_OIDC_ISSUER_URL=https://id.nuclide.systems
|
|
CODER_OIDC_CLIENT_ID=<client-id>
|
|
CODER_OIDC_CLIENT_SECRET=<client-secret>
|
|
CODER_OIDC_SCOPES=openid,profile,email
|
|
CODER_DISABLE_PASSWORD_AUTH=true
|
|
```
|
|
|
|
### Generic (any service with standard OIDC)
|
|
|
|
```
|
|
Issuer: https://id.nuclide.systems
|
|
Auth URL: https://id.nuclide.systems/authorize
|
|
Token URL: https://id.nuclide.systems/api/oidc/token
|
|
Userinfo URL: https://id.nuclide.systems/api/oidc/userinfo
|
|
JWKS URL: https://id.nuclide.systems/api/oidc/jwks
|
|
Scopes: openid profile email
|
|
```
|
|
|
|
## Backup
|
|
|
|
Pocket-ID SQLite DB + signing keys are backed up nightly via Backrest (CT 103). Pre-backup hook SSHs to CT 110, runs `pocket-id export` inside the container, copies the ZIP + signing keys to UNAS staging path, then the `services-backup-plan` snapshots to JottaCloud. See `services/backrest.md`.
|
|
|
|
## Stack location
|
|
|
|
CT 110 (`192.168.1.5`): `/opt/stacks/pocketid/docker-compose.yml`
|
|
|
|
```yaml
|
|
# key env vars
|
|
POCKET_ID_URL=https://id.nuclide.systems
|
|
TRUST_PROXY=true
|
|
MAXMIND_LICENSE_KEY=... # optional geo-IP
|
|
```
|