This repository has no description
configs.zitadel: offer byoidc as "Your own provider"
Account linking is off: byoidc never marks emails verified and anyone can
run a provider claiming any address. New users are created automatically.
author
Hermes
committer
lassulus
date
(Oct 17, 2026, 2:30 PM CEST)
commit
96dcfb07
96dcfb07dbee084d6f602f123a3de310e8fdf8fd
parent
138fdfcb
138fdfcb445a2fc0538755d89f2f1ac4d1ed3e38
+18
-2
+18
-2
configs/zitadel.nix
+18
-2
configs/zitadel.nix
···
42
42
{
43
43
# Zitadel: identity provider for lassul.us services (OIDC). Anyone can
44
44
# register; users sign in with a passkey or an external login (GitHub,
45
-
# Google, other OIDC) linked to their account. The login policy, the GitHub
46
-
# and Google logins and the services' projects and OIDC apps come from
45
+
# Google, their own OpenID provider via byoidc) linked to their account. The
46
+
# login policy, these logins and the services' projects and OIDC apps come from
47
47
# lass.zitadel (modules/zitadel); the zitadel-reconcile service applies
48
48
# them. Further IdPs and the grants of "managed" projects are done in the
49
49
# console at https://id.lassul.us/ui/console.
···
144
144
"profile"
145
145
"email"
146
146
];
147
+
};
148
+
# byoidc (configs/byoidc.nix): sign in with any OpenID provider. Anyone
149
+
# can run one that claims any email address, so these accounts are never
150
+
# linked to existing ones.
151
+
byoidc = {
152
+
type = "oidc";
153
+
name = "Your own provider";
154
+
issuer = "https://byoidc.lassul.us";
155
+
clientId = "zitadel";
156
+
clientSecretFile = config.clan.core.vars.generators.byoidc.files."client-secret".path;
157
+
providerOptions = {
158
+
isLinkingAllowed = false;
159
+
isCreationAllowed = true;
160
+
isAutoCreation = true;
161
+
isAutoUpdate = true;
162
+
};
147
163
};
148
164
};
149
165
clan.core.vars.generators.zitadel-github =