add pocket-id for auth

platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyB3ajlu
+V0RkeHB5WE8zWGhrYnFpaU9LQ2l0dHd6bWNydll6Y3F4ampaT0JnCi9QTS81aldn
+NVhhSm00RWJDaHl0V0ludEJleW9HaitKNlZwQlFRcWdVZUUKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIG8waldTNzdJNmJKQjdPS2ZpV1ZpcTN3RGVjSHR5UmlyQzBsM3Va
+SFdLM2sKYVhhczRxS1BNdElSN3ppa2ZPNjZhajFhVlVkNngydFlibHhTYVZFWS9C
+cwotPiBzc2gtZWQyNTUxOSBuanZYNUEgeVBqak4yelZnUXBZbFMrR3AzU05hNldy
+NDl4SkpTY1BBS2xHQ3J5TkZ3TQpYRGJKSlFzMFB5c3lWMGZKOTl1TWRURnk3U3hi
+dkMrK0FDNVVKL3RzTXJBCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBEQXlSRFpNYVRN
+bTdFejNXMEcvaGZkbDF1NnFjZFdXdHpFV2ZjMGhMWWtNCkpvTFJVUUF0eEl1U2N0
+Z1hScXRXQndxU3kzL0pPYjNQL01XUzUwbTFwRUEKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IHpNVnUwWURYSHFHMUxVMmhIZkMrdHBEYVdEQTZ0R3plcU1Na21IQkZoSHMK
+THBiRlg2NWhFcSs0SkUveTRMdXdxajl1emFoV0NvTmRSZ3JTZTltZFovQQotLS0g
+aUg4aEIwWHhkZFFNVnQ5ZVJpWjlFQis3Tjk5NHBNMWVzTTYxdEdhSlJ6VQrk/zq+
+MS3OPv0vbS4yDmLFFrJUdUPj0WuJ/yPp32Elz3+FW7QFDqNKChZnC3rTTVjc/MKL
+IVlGYXpoYuwve4ABi40QAcN0Qs8XqeIt2A==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/pocket-id/pocket-id.nix

@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.pocket-id;
+in
+
+{
+
+  options.nmasur.presets.services.pocket-id.enable = lib.mkEnableOption "Pocket ID OIDC provider";
+
+  config = lib.mkIf cfg.enable {
+
+    secrets.pocket-id = {
+      source = ./pocket-id.age;
+      dest = "${config.secretsDirectory}/pocket-id";
+      owner = "pocket-id";
+      group = "pocket-id";
+      permissions = "0440";
+    };
+    systemd.services.pocket-id-secret = {
+      requiredBy = [ "pocket-id.service" ];
+      before = [ "pocket-id.service" ];
+    };
+
+    services.pocket-id = {
+      enable = true;
+      settings = {
+        APP_URL = "https://${hostnames.auth}";
+        TRUST_PROXY = true;
+        PORT = 3034;
+      };
+      credentials = {
+        ENCRYPTION_KEY = config.secrets.pocket-id.dest;
+      };
+    };
+
+    # Allow web traffic to Caddy
+    nmasur.presets.services.caddy.routes = [
+      {
+        match = [ { host = [ hostnames.auth ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [
+              { dial = "localhost:${builtins.toString config.services.pocket-id.settings.PORT}"; }
+            ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.auth ];
+
+  };
+
+}

platforms/nixos/modules/nmasur/profiles/communications.nix

@@ -55,6 +55,7 @@ in
         nix-autoupgrade.enable = lib.mkDefault true; # On by default for communications
         ntfy-sh.enable = lib.mkDefault true;
         pgweb.enable = lib.mkDefault true;
+        pocket-id.enable = lib.mkDefault true;
         postgresql.enable = lib.mkDefault true;
         stalwart.enable = lib.mkDefault true;
         thelounge.enable = lib.mkDefault true;