From 90dc80f7b48467b5614aff2bec8e443b60b71ec8 Mon Sep 17 00:00:00 2001
From: Noah Masur <7386960+nmasur@users.noreply.github.com>
Date: Sat, 5 Sep 2026 21:24:01 +0000
Subject: [PATCH] add pocket-id for auth

---
 flake.nix                                     |  1 +
 .../presets/services/pocket-id/pocket-id.age  | 17 ++++++
 .../presets/services/pocket-id/pocket-id.nix  | 58 +++++++++++++++++++
 .../nmasur/profiles/communications.nix        |  1 +
 4 files changed, 77 insertions(+)
 create mode 100644 platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.age
 create mode 100644 platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.nix

diff --git a/flake.nix b/flake.nix
index 3aa47740..5efd8e3b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -128,6 +128,7 @@
         in
         {
           audiobooks = "read.${baseName}";
+          auth = "auth.${baseName}";
           bookmarks = "keep.${baseName}";
           books = "books.${baseName}";
           budget = "money.${baseName}";
diff --git a/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.age b/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.age
new file mode 100644
index 00000000..5f5a42c2
--- /dev/null
+++ b/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.age
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyB3ajlu
+V0RkeHB5WE8zWGhrYnFpaU9LQ2l0dHd6bWNydll6Y3F4ampaT0JnCi9QTS81aldn
+NVhhSm00RWJDaHl0V0ludEJleW9HaitKNlZwQlFRcWdVZUUKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIG8waldTNzdJNmJKQjdPS2ZpV1ZpcTN3RGVjSHR5UmlyQzBsM3Va
+SFdLM2sKYVhhczRxS1BNdElSN3ppa2ZPNjZhajFhVlVkNngydFlibHhTYVZFWS9C
+cwotPiBzc2gtZWQyNTUxOSBuanZYNUEgeVBqak4yelZnUXBZbFMrR3AzU05hNldy
+NDl4SkpTY1BBS2xHQ3J5TkZ3TQpYRGJKSlFzMFB5c3lWMGZKOTl1TWRURnk3U3hi
+dkMrK0FDNVVKL3RzTXJBCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBEQXlSRFpNYVRN
+bTdFejNXMEcvaGZkbDF1NnFjZFdXdHpFV2ZjMGhMWWtNCkpvTFJVUUF0eEl1U2N0
+Z1hScXRXQndxU3kzL0pPYjNQL01XUzUwbTFwRUEKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IHpNVnUwWURYSHFHMUxVMmhIZkMrdHBEYVdEQTZ0R3plcU1Na21IQkZoSHMK
+THBiRlg2NWhFcSs0SkUveTRMdXdxajl1emFoV0NvTmRSZ3JTZTltZFovQQotLS0g
+aUg4aEIwWHhkZFFNVnQ5ZVJpWjlFQis3Tjk5NHBNMWVzTTYxdEdhSlJ6VQrk/zq+
+MS3OPv0vbS4yDmLFFrJUdUPj0WuJ/yPp32Elz3+FW7QFDqNKChZnC3rTTVjc/MKL
+IVlGYXpoYuwve4ABi40QAcN0Qs8XqeIt2A==
+-----END AGE ENCRYPTED FILE-----
diff --git a/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.nix b/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.nix
new file mode 100644
index 00000000..ad7c2027
--- /dev/null
+++ b/platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.nix
@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.pocket-id;
+in
+
+{
+
+  options.nmasur.presets.services.pocket-id.enable = lib.mkEnableOption "Pocket ID OIDC provider";
+
+  config = lib.mkIf cfg.enable {
+
+    secrets.pocket-id = {
+      source = ./pocket-id.age;
+      dest = "${config.secretsDirectory}/pocket-id";
+      owner = "pocket-id";
+      group = "pocket-id";
+      permissions = "0440";
+    };
+    systemd.services.pocket-id-secret = {
+      requiredBy = [ "pocket-id.service" ];
+      before = [ "pocket-id.service" ];
+    };
+
+    services.pocket-id = {
+      enable = true;
+      settings = {
+        APP_URL = "https://${hostnames.auth}";
+        TRUST_PROXY = true;
+        PORT = 3034;
+      };
+      credentials = {
+        ENCRYPTION_KEY = config.secrets.pocket-id.dest;
+      };
+    };
+
+    # Allow web traffic to Caddy
+    nmasur.presets.services.caddy.routes = [
+      {
+        match = [ { host = [ hostnames.auth ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [
+              { dial = "localhost:${builtins.toString config.services.pocket-id.settings.PORT}"; }
+            ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.auth ];
+
+  };
+
+}
diff --git a/platforms/nixos/modules/nmasur/profiles/communications.nix b/platforms/nixos/modules/nmasur/profiles/communications.nix
index 0e828c77..8f109972 100644
--- a/platforms/nixos/modules/nmasur/profiles/communications.nix
+++ b/platforms/nixos/modules/nmasur/profiles/communications.nix
@@ -55,6 +55,7 @@ in
         nix-autoupgrade.enable = lib.mkDefault true; # On by default for communications
         ntfy-sh.enable = lib.mkDefault true;
         pgweb.enable = lib.mkDefault true;
+        pocket-id.enable = lib.mkDefault true;
         postgresql.enable = lib.mkDefault true;
         stalwart.enable = lib.mkDefault true;
         thelounge.enable = lib.mkDefault true;