This repository has no description
tools.hedgedoc: add pocket-id OIDC login alongside GitHub
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
57ef39b0
57ef39b0109936041659960d2fd9733d91aecea4
parent
7f6f51a7
7f6f51a7459fe423a2ab0c0fcbbe267750ef5b5f
+35
-1
+35
-1
2configs/services/pad/default.nix
+35
-1
2configs/services/pad/default.nix
···
2
2
{
3
3
imports = [ ./module.nix ];
4
4
clan.hedgedoc.domain = "pad.lassul.us";
5
+
6
+
# GitHub login (https://github.com/settings/applications/2352617)
5
7
clan.core.vars.generators.hedgedoc-github-auth = {
6
8
files."hedgedoc.env" = { };
7
9
prompts."hedgedoc.env" = {
···
13
15
type = "multiline";
14
16
};
15
17
};
16
-
# https://github.com/settings/applications/2352617
18
+
19
+
# pocket-id (id.lassul.us) OIDC login, offered alongside GitHub. The endpoints
20
+
# are public config; only the client id/secret are secret (clan vars below).
21
+
# Register the client in pocket-id with callback URL:
22
+
# https://pad.lassul.us/auth/oauth2/callback
23
+
services.hedgedoc.settings.oauth2 = {
24
+
providerName = "pocket-id";
25
+
authorizationURL = "https://id.lassul.us/authorize";
26
+
tokenURL = "https://id.lassul.us/api/oidc/token";
27
+
userProfileURL = "https://id.lassul.us/api/oidc/userinfo";
28
+
scope = "openid email profile";
29
+
userProfileUsernameAttr = "preferred_username";
30
+
userProfileDisplayNameAttr = "name";
31
+
userProfileEmailAttr = "email";
32
+
};
33
+
clan.core.vars.generators.hedgedoc-pocket-id = {
34
+
files."pocket-id.env" = { };
35
+
prompts."pocket-id.env" = {
36
+
description = ''
37
+
Register an OIDC client in pocket-id (https://id.lassul.us):
38
+
name: HedgeDoc
39
+
callback URL: https://pad.lassul.us/auth/oauth2/callback
40
+
Generate a client secret, then paste:
41
+
CMD_OAUTH2_CLIENT_ID=...
42
+
CMD_OAUTH2_CLIENT_SECRET=...
43
+
'';
44
+
type = "multiline";
45
+
};
46
+
};
47
+
48
+
# GitHub session-secret env comes from module.nix; append both external-auth
49
+
# env files here (systemd merges the EnvironmentFile lists).
17
50
systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
18
51
config.clan.core.vars.generators.hedgedoc-github-auth.files."hedgedoc.env".path
52
+
config.clan.core.vars.generators.hedgedoc-pocket-id.files."pocket-id.env".path
19
53
];
20
54
}