This repository has no description
configs.byoidc: init on neoprism (byoidc.lassul.us)
byoidc lets people sign in with their own OpenID provider; Zitadel will
offer it as one generic OIDC IdP. The downstream client "zitadel" gets its
secret from a prompt-less clan var, which root-owned is fine for both
byoidc (LoadCredential) and zitadel-reconcile (root).
Its state (cached upstream clients, signing key) is not backed up: subjects
are derived from issuer and upstream sub, a new signing key is picked up
through JWKS, and upstream clients are registered again on demand.
author
Hermes
committer
lassulus
date
(Oct 17, 2026, 2:30 PM CEST)
commit
7029bd13
7029bd13148df9a2d48a6f493ae28fdd0dd1e621
parent
d9ddd15b
d9ddd15b83485a80bbf38e53961c2fc33473c7ae
+85
+24
flake.lock
+24
flake.lock
···
50
50
"type": "github"
51
51
}
52
52
},
53
+
"byoidc": {
54
+
"inputs": {
55
+
"nixpkgs": [
56
+
"nixpkgs"
57
+
],
58
+
"treefmt-nix": [
59
+
"treefmt-nix"
60
+
]
61
+
},
62
+
"locked": {
63
+
"lastModified": 1792238066,
64
+
"narHash": "sha256-eoBatHVF4jH7WNxR4Am7gGMn4e4V1M90O9iQFR5Vbrc=",
65
+
"owner": "lassulus",
66
+
"repo": "byoidc",
67
+
"rev": "ccc087d194318290f9b749b3182c976285e4d758",
68
+
"type": "github"
69
+
},
70
+
"original": {
71
+
"owner": "lassulus",
72
+
"repo": "byoidc",
73
+
"type": "github"
74
+
}
75
+
},
53
76
"clan-core": {
54
77
"inputs": {
55
78
"data-mesher": [],
···
649
672
},
650
673
"root": {
651
674
"inputs": {
675
+
"byoidc": "byoidc",
652
676
"clan-core": "clan-core",
653
677
"disko": "disko",
654
678
"hermes-agent": "hermes-agent",
+4
flake.nix
+4
flake.nix
+53
configs/byoidc.nix
+53
configs/byoidc.nix
···
1
+
let
2
+
domain = "byoidc.lassul.us";
3
+
port = 8773;
4
+
in
5
+
{
6
+
config,
7
+
pkgs,
8
+
self,
9
+
...
10
+
}:
11
+
{
12
+
# byoidc: OIDC provider that signs users in with their own OpenID provider.
13
+
# Zitadel offers it as the IdP "Your own provider" (configs/zitadel.nix),
14
+
# which uses the client "zitadel" below with the same client secret.
15
+
imports = [ self.inputs.byoidc.nixosModules.byoidc ];
16
+
17
+
services.byoidc = {
18
+
enable = true;
19
+
listen = "127.0.0.1:${toString port}";
20
+
publicUrl = "https://${domain}";
21
+
clientName = "byoidc (lassul.us)";
22
+
clientUri = "https://lassul.us";
23
+
trustForwardedFor = true;
24
+
client = {
25
+
id = "zitadel";
26
+
secretFile = config.clan.core.vars.generators.byoidc.files."client-secret".path;
27
+
redirectUris = [ "https://id.lassul.us/ui/login/login/externalidp/callback" ];
28
+
};
29
+
};
30
+
31
+
clan.core.vars.generators.byoidc = {
32
+
files."client-secret" = { };
33
+
runtimeInputs = [ pkgs.openssl ];
34
+
script = ''
35
+
openssl rand -hex 32 | tr -d '\n' > "$out/client-secret"
36
+
'';
37
+
};
38
+
39
+
services.nginx.virtualHosts.${domain} = {
40
+
enableACME = true;
41
+
forceSSL = true;
42
+
locations."/" = {
43
+
proxyPass = "http://127.0.0.1:${toString port}";
44
+
# byoidc rate-limits on the last X-Forwarded-For entry; set it from the
45
+
# socket, never from a client-supplied header.
46
+
extraConfig = ''
47
+
proxy_set_header Host $host;
48
+
proxy_set_header X-Forwarded-For $remote_addr;
49
+
proxy_set_header X-Forwarded-Proto $scheme;
50
+
'';
51
+
};
52
+
};
53
+
}
+1
configs/dns/lassul.us.zone
+1
configs/dns/lassul.us.zone
+1
configs/monitoring/checks.nix
+1
configs/monitoring/checks.nix
···
50
50
(https "matrix" "https://matrix.lassul.us/_matrix/client/versions")
51
51
(https "pad" "https://pad.lassul.us/")
52
52
(https "id" "https://id.lassul.us/debug/healthz")
53
+
(https "byoidc" "https://byoidc.lassul.us/healthz")
53
54
(https "paint" "https://paint.lassul.us/")
54
55
(https "ntfy" "https://ntfy.lassul.us/v1/health")
55
56
(https "cache" "https://cache.lassul.us/nix-cache-info")
+2
machines/neoprism/config.nix
+2
machines/neoprism/config.nix