add pocket-id for auth

2026-09-09 03:36:07 +00:00 · 2026-09-06 12:18:17 +00:00
parent aff596aa64
commit 90dc80f7b4
4 changed files with 77 additions and 0 deletions
@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.pocket-id;
+in
+
+{
+
+  options.nmasur.presets.services.pocket-id.enable = lib.mkEnableOption "Pocket ID OIDC provider";
+
+  config = lib.mkIf cfg.enable {
+
+    secrets.pocket-id = {
+      source = ./pocket-id.age;
+      dest = "${config.secretsDirectory}/pocket-id";
+      owner = "pocket-id";
+      group = "pocket-id";
+      permissions = "0440";
+    };
+    systemd.services.pocket-id-secret = {
+      requiredBy = [ "pocket-id.service" ];
+      before = [ "pocket-id.service" ];
+    };
+
+    services.pocket-id = {
+      enable = true;
+      settings = {
+        APP_URL = "https://${hostnames.auth}";
+        TRUST_PROXY = true;
+        PORT = 3034;
+      };
+      credentials = {
+        ENCRYPTION_KEY = config.secrets.pocket-id.dest;
+      };
+    };
+
+    # Allow web traffic to Caddy
+    nmasur.presets.services.caddy.routes = [
+      {
+        match = [ { host = [ hostnames.auth ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [
+              { dial = "localhost:${builtins.toString config.services.pocket-id.settings.PORT}"; }
+            ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.auth ];
+
+  };
+
+}