selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 15: Pocket ID as identity provider, tinyauth gate, offboarding script

Browse source 
Pocket ID replaces Forgejo as the OIDC provider for Outline, Vaultwarden and
NetBird; Forgejo logs in through it. Uptime Kuma sits behind tinyauth via
Caddy forward_auth (group ops), the public status page stays public.

offboarding/offboard.py switches one person off in every service with an API
and prints what a human still has to do: the shared passwords they could read.
Measured: SSO lock alone left 10 of 13 ways open for 45 minutes; the script
leaves 1 of 14, the vault copy on their laptop.

HARDENING.md: the ufw hairpin that broke Vaultwarden SSO and Kuma, the mesh
route into the docker bridges, and a fail2ban exception for Pocket ID.
This commit is contained in:
Maximilian Grimm 2026-09-23 11:52:17 +02:00
parent 3edef38ba3
commit 12542ecb19
9 changed files with 490 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

20
.env.example
View file

@ -14,8 +14,8 @@ TZ=Europe/Berlin
OUTLINE_PG_PASSWORD=CHANGE_ME_openssl_rand_hex_32
OUTLINE_SECRET_KEY=CHANGE_ME_openssl_rand_hex_32
OUTLINE_UTILS_SECRET=CHANGE_ME_openssl_rand_hex_32
# From Forgejo: Site Administration -> Applications -> OAuth2
# Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback
# From Pocket ID (episode 15): Administration -> OIDC Clients, allowed group staff
# Callback URL: https://wiki.<DOMAIN>/auth/oidc.callback
OUTLINE_OIDC_CLIENT_ID=
OUTLINE_OIDC_CLIENT_SECRET=
@ -24,9 +24,9 @@ OUTLINE_OIDC_CLIENT_SECRET=
VAULTWARDEN_ADMIN_TOKEN=CHANGE_ME_openssl_rand_hex_32
# Flip to false once your team has signed up:
VAULTWARDEN_SIGNUPS_ALLOWED=true
# Single sign-on against your own Forgejo (episode 4).
# From Forgejo: Site Administration -> Applications -> OAuth2 Application
# Redirect URI must be EXACTLY: https://vault.<DOMAIN>/identity/connect/oidc-signin
# Single sign-on (episode 4 with Forgejo, since episode 15 Pocket ID).
# From Pocket ID: Administration -> OIDC Clients, allowed group staff
# Callback URL must be EXACTLY: https://vault.<DOMAIN>/identity/connect/oidc-signin
VAULTWARDEN_SSO_CLIENT_ID=
VAULTWARDEN_SSO_CLIENT_SECRET=
@ -84,3 +84,13 @@ OPS_ACTIONS_TOKEN=
# cscli bouncers add caddy-bouncer -o raw
# Without it Caddy still starts, but blocks nothing and logs auth errors.
CROWDSEC_BOUNCER_KEY=
# --- Episode 15: Pocket ID + tinyauth ---------------------------------------
# Encrypts Pocket ID's signing keys at rest: openssl rand -base64 32
# Then open https://id.<DOMAIN>/setup IMMEDIATELY: until the first admin
# exists, that page belongs to whoever finds it first (scanners did, in seconds).
POCKET_ID_ENCRYPTION_KEY=
# The OIDC client "Tinyauth" in Pocket ID
# (callback https://auth.<DOMAIN>/api/oauth/callback/pocketid, allowed group ops).
TINYAUTH_CLIENT_ID=
TINYAUTH_CLIENT_SECRET=