selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 15: Pocket ID as identity provider, tinyauth gate, offboarding script

Browse source 
Pocket ID replaces Forgejo as the OIDC provider for Outline, Vaultwarden and
NetBird; Forgejo logs in through it. Uptime Kuma sits behind tinyauth via
Caddy forward_auth (group ops), the public status page stays public.

offboarding/offboard.py switches one person off in every service with an API
and prints what a human still has to do: the shared passwords they could read.
Measured: SSO lock alone left 10 of 13 ways open for 45 minutes; the script
leaves 1 of 14, the vault copy on their laptop.

HARDENING.md: the ufw hairpin that broke Vaultwarden SSO and Kuma, the mesh
route into the docker bridges, and a fail2ban exception for Pocket ID.
This commit is contained in:
Maximilian Grimm 2026-09-23 11:52:17 +02:00
parent 3edef38ba3
commit 12542ecb19
9 changed files with 490 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

13
offboarding/offboard.env.example Normal file
View file

@ -0,0 +1,13 @@
# offboard.env: copy to offboard.env (chmod 600), fill in, never commit.
# DOMAIN and VAULTWARDEN_ADMIN_TOKEN are read from the stack's .env.
# Pocket ID: Settings -> Admin -> API Keys (set an expiry)
POCKET_ID_API_KEY=
# Forgejo: forgejo admin user generate-access-token --username <admin> --token-name offboarding --scopes write:admin --raw
FORGEJO_ADMIN_TOKEN=
# Outline: API key of a workspace admin (Settings -> API)
OUTLINE_API_KEY=
# NetBird: service user with role admin -> personal access token
NETBIRD_PAT=
# n8n: Settings -> n8n API (owner)
N8N_API_KEY=