This repository has no description
1.1 kB
45 lines
1let
2 domain = "id.lassul.us";
3 port = 1411;
4in
5{
6 config,
7 pkgs,
8 ...
9}:
10{
11 # Pocket ID: passkey-based OIDC provider. Serves as the SSO IdP for other
12 # services on this host (e.g. HedgeDoc login at pad.lassul.us). First-run
13 # bootstrap (admin user + OIDC client registration) happens through its web
14 # UI at https://id.lassul.us.
15
16 # v2 requires ENCRYPTION_KEY (>=16 bytes) to encrypt keys at rest.
17 clan.core.vars.generators.pocket-id = {
18 files."encryption_key" = { };
19 runtimeInputs = [ pkgs.openssl ];
20 script = ''
21 openssl rand -hex 32 | tr -d '\n' > "$out/encryption_key"
22 '';
23 };
24
25 services.pocket-id = {
26 enable = true;
27 credentials.ENCRYPTION_KEY = config.clan.core.vars.generators.pocket-id.files."encryption_key".path;
28 settings = {
29 APP_URL = "https://${domain}";
30 TRUST_PROXY = true;
31 ANALYTICS_DISABLED = true;
32 HOST = "127.0.0.1";
33 PORT = port;
34 };
35 };
36
37 services.nginx.virtualHosts.${domain} = {
38 enableACME = true;
39 forceSSL = true;
40 locations."/" = {
41 proxyPass = "http://127.0.0.1:${toString port}";
42 proxyWebsockets = true;
43 };
44 };
45}