57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
46 lines
1.7 KiB
Markdown
46 lines
1.7 KiB
Markdown
# pocket-id
|
|
|
|
[Pocket-ID](https://pocket-id.org) OIDC provider behind Caddy, with an optional
|
|
[Anubis](https://github.com/TecharoHQ/anubis) proof-of-work anti-bot gate. The
|
|
identity provider for the other stacks (headscale, beszel, webfinger).
|
|
|
|
## Required `.env` values
|
|
|
|
| Variable | Notes |
|
|
|----------|-------|
|
|
| `POCKETID_DOMAIN` | Public hostname (e.g. `id.example.com`). |
|
|
| `ACME_EMAIL` | Let's Encrypt registration email. |
|
|
| `ENCRYPTION_KEY` | Generated on first deploy (`openssl rand -base64 32`). Losing it is unrecoverable. |
|
|
| `ANUBIS_PID_KEY` | Generated on first deploy (`openssl rand -hex 32`). |
|
|
|
|
`MAXMIND_LICENSE_KEY` (audit-log geolocation) is optional. See
|
|
[`.env.example`](.env.example) for the full list.
|
|
|
|
**Optional WebFinger:** set `BASE_DOMAIN` (and `REDIRECT_URL`) to have this
|
|
Caddy also serve `/.well-known/webfinger` at the apex — useful when the base
|
|
domain has no other web server. Leave both blank to run pocket-id only and use
|
|
the dedicated [`webfinger`](../webfinger/) deployment instead.
|
|
|
|
## Deploy
|
|
|
|
From the repo root via the launcher:
|
|
|
|
```bash
|
|
./automations.sh # Deploy on this host → deploy: pocket-id
|
|
```
|
|
|
|
Or build the self-contained artifact and run it on the host:
|
|
|
|
```bash
|
|
./build.sh # embeds files into deploy.sh
|
|
scp deploy.sh root@host: # copy to the target
|
|
ssh root@host 'bash deploy.sh' # interactive
|
|
# non-interactive:
|
|
# POCKETID_DOMAIN=id.example.com ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
|
|
```
|
|
|
|
Unattended provisioning: [`cloud-init.yml`](cloud-init.yml).
|
|
|
|
DNS for `POCKETID_DOMAIN` must resolve to the host and ports 80/443 be
|
|
reachable before deploy, or the LE cert request fails.
|