This repository has no description
2configs/pocket-id: add passkey OIDC provider (id.lassul.us)
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
32a31d84
32a31d84eb292c44047a7ba6b71d5d4fd893e820
parent
6f6a4e83
6f6a4e83ec226e36d8ae1dafb01118ea6168afe6
+50
-1
+45
2configs/pocket-id.nix
+45
2configs/pocket-id.nix
···
1
+
let
2
+
domain = "id.lassul.us";
3
+
port = 1411;
4
+
in
5
+
{
6
+
config,
7
+
pkgs,
8
+
...
9
+
}:
10
+
{
11
+
# Pocket ID: passkey-based OIDC provider. Serves as the SSO IdP for other
12
+
# services on this host (e.g. the SilverBullet editing instance via
13
+
# oauth2-proxy). First-run bootstrap (admin user + OIDC client registration)
14
+
# happens through its web UI at https://id.lassul.us.
15
+
16
+
# v2 requires ENCRYPTION_KEY (>=16 bytes) to encrypt keys at rest.
17
+
clan.core.vars.generators.pocket-id = {
18
+
files."encryption_key" = { };
19
+
runtimeInputs = [ pkgs.openssl ];
20
+
script = ''
21
+
openssl rand -hex 32 | tr -d '\n' > "$out/encryption_key"
22
+
'';
23
+
};
24
+
25
+
services.pocket-id = {
26
+
enable = true;
27
+
credentials.ENCRYPTION_KEY = config.clan.core.vars.generators.pocket-id.files."encryption_key".path;
28
+
settings = {
29
+
APP_URL = "https://${domain}";
30
+
TRUST_PROXY = true;
31
+
ANALYTICS_DISABLED = true;
32
+
HOST = "127.0.0.1";
33
+
PORT = port;
34
+
};
35
+
};
36
+
37
+
services.nginx.virtualHosts.${domain} = {
38
+
enableACME = true;
39
+
forceSSL = true;
40
+
locations."/" = {
41
+
proxyPass = "http://127.0.0.1:${toString port}";
42
+
proxyWebsockets = true;
43
+
};
44
+
};
45
+
}
+2
-1
2configs/dns/lassul.us.zone
+2
-1
2configs/dns/lassul.us.zone
···
1
-
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060700 7200 3600 86400 3600
1
+
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060705 7200 3600 86400 3600
2
2
3
3
;;@ 3600 IN NS ns1
4
4
@ 3600 IN NS ns1
···
55
55
cal IN CNAME neoprism
56
56
kanban IN CNAME neoprism
57
57
n2n IN CNAME neoprism
58
+
id IN CNAME neoprism
58
59
59
60
;; Mail
60
61
@ IN MX 3 mail
+3
machines/neoprism/config.nix
+3
machines/neoprism/config.nix