# pocket-id

[Pocket-ID](https://pocket-id.org) OIDC provider behind Caddy, with an optional
[Anubis](https://github.com/TecharoHQ/anubis) proof-of-work anti-bot gate. The
identity provider for the other stacks (headscale, beszel, webfinger).

## Required `.env` values

| Variable | Notes |
|----------|-------|
| `POCKETID_DOMAIN` | Public hostname (e.g. `id.example.com`). |
| `ACME_EMAIL` | Let's Encrypt registration email. |
| `ENCRYPTION_KEY` | Generated on first deploy (`openssl rand -base64 32`). Losing it is unrecoverable. |
| `ANUBIS_PID_KEY` | Generated on first deploy (`openssl rand -hex 32`). |

`MAXMIND_LICENSE_KEY` (audit-log geolocation) is optional. See
[`.env.example`](.env.example) for the full list.

**Optional WebFinger:** set `BASE_DOMAIN` (and `REDIRECT_URL`) to have this
Caddy also serve `/.well-known/webfinger` at the apex — useful when the base
domain has no other web server. Leave both blank to run pocket-id only and use
the dedicated [`webfinger`](../webfinger/) deployment instead.

## Deploy

From the repo root via the launcher:

```bash
./automations.sh        # Deploy on this host → deploy: pocket-id
```

Or build the self-contained artifact and run it on the host:

```bash
./build.sh                                  # embeds files into deploy.sh
scp deploy.sh root@host:                     # copy to the target
ssh root@host 'bash deploy.sh'               # interactive
# non-interactive:
#   POCKETID_DOMAIN=id.example.com ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
```

Unattended provisioning: [`cloud-init.yml`](cloud-init.yml).

DNS for `POCKETID_DOMAIN` must resolve to the host and ports 80/443 be
reachable before deploy, or the LE cert request fails.