This repository has no description
configs.services.pad: log in via zitadel instead of pocket-id
id.lassul.us is Zitadel now; its endpoints are /oauth/v2/authorize,
/oauth/v2/token and /oidc/v1/userinfo (from its discovery document). The
pad project is public: every registered user may log in. zitadel-reconcile
creates the HedgeDoc app and writes its client id/secret into the env file
HedgeDoc reads, so there is no prompt var for them; hedgedoc starts after
it. HedgeDoc posts the client secret in the token request body, hence the
POST auth method.
author
Hermes
committer
lassulus
date
(Oct 17, 2026, 1:13 PM CEST)
commit
d9ddd15b
d9ddd15b83485a80bbf38e53961c2fc33473c7ae
parent
292d2f4b
292d2f4bf43633bdaf830c571808cdc545ec7631
+28
-26
+28
-26
configs/services/pad/default.nix
+28
-26
configs/services/pad/default.nix
···
16
16
};
17
17
};
18
18
19
-
# pocket-id (id.lassul.us) OIDC login, offered alongside GitHub. The endpoints
20
-
# are public config; only the client id/secret are secret (clan vars below).
21
-
# Register the client in pocket-id with callback URL:
22
-
# https://pad.lassul.us/auth/oauth2/callback
19
+
# Zitadel (id.lassul.us) OIDC login, offered alongside GitHub, open to every
20
+
# registered user. zitadel-reconcile creates the app and writes its client
21
+
# id/secret into the env file below.
22
+
lass.zitadel.projects.pad = {
23
+
access = "public";
24
+
apps.hedgedoc = {
25
+
redirectUris = [ "https://pad.lassul.us/auth/oauth2/callback" ];
26
+
# HedgeDoc sends the secret in the token request body.
27
+
authMethod = "post";
28
+
envFile = {
29
+
owner = "hedgedoc";
30
+
clientIdVariable = "CMD_OAUTH2_CLIENT_ID";
31
+
clientSecretVariable = "CMD_OAUTH2_CLIENT_SECRET";
32
+
};
33
+
};
34
+
};
23
35
services.hedgedoc.settings.oauth2 = {
24
-
providerName = "pocket-id";
25
-
authorizationURL = "https://id.lassul.us/authorize";
26
-
tokenURL = "https://id.lassul.us/api/oidc/token";
27
-
userProfileURL = "https://id.lassul.us/api/oidc/userinfo";
36
+
providerName = "lassul.us ID";
37
+
authorizationURL = "https://id.lassul.us/oauth/v2/authorize";
38
+
tokenURL = "https://id.lassul.us/oauth/v2/token";
39
+
userProfileURL = "https://id.lassul.us/oidc/v1/userinfo";
28
40
scope = "openid email profile";
29
41
userProfileUsernameAttr = "preferred_username";
30
42
userProfileDisplayNameAttr = "name";
31
43
userProfileEmailAttr = "email";
32
44
};
33
-
clan.core.vars.generators.hedgedoc-pocket-id = {
34
-
files."pocket-id.env" = { };
35
-
prompts."pocket-id.env" = {
36
-
description = ''
37
-
Register an OIDC client in pocket-id (https://id.lassul.us):
38
-
name: HedgeDoc
39
-
callback URL: https://pad.lassul.us/auth/oauth2/callback
40
-
Generate a client secret, then paste:
41
-
CMD_OAUTH2_CLIENT_ID=...
42
-
CMD_OAUTH2_CLIENT_SECRET=...
43
-
'';
44
-
type = "multiline";
45
-
};
46
-
};
47
45
48
46
# GitHub session-secret env comes from module.nix; append both external-auth
49
47
# env files here (systemd merges the EnvironmentFile lists).
50
-
systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
51
-
config.clan.core.vars.generators.hedgedoc-github-auth.files."hedgedoc.env".path
52
-
config.clan.core.vars.generators.hedgedoc-pocket-id.files."pocket-id.env".path
53
-
];
48
+
systemd.services.hedgedoc = {
49
+
wants = [ "zitadel-reconcile.service" ];
50
+
after = [ "zitadel-reconcile.service" ];
51
+
serviceConfig.EnvironmentFile = [
52
+
config.clan.core.vars.generators.hedgedoc-github-auth.files."hedgedoc.env".path
53
+
config.lass.zitadel.projects.pad.apps.hedgedoc.envFile.path
54
+
];
55
+
};
54
56
}