57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
pocket-id
Pocket-ID OIDC provider behind Caddy, with an optional Anubis proof-of-work anti-bot gate. The identity provider for the other stacks (headscale, beszel, webfinger).
Required .env values
| Variable | Notes |
|---|---|
POCKETID_DOMAIN |
Public hostname (e.g. id.example.com). |
ACME_EMAIL |
Let's Encrypt registration email. |
ENCRYPTION_KEY |
Generated on first deploy (openssl rand -base64 32). Losing it is unrecoverable. |
ANUBIS_PID_KEY |
Generated on first deploy (openssl rand -hex 32). |
MAXMIND_LICENSE_KEY (audit-log geolocation) is optional. See
.env.example for the full list.
Deploy
From the repo root via the launcher:
./automations.sh # Deploy on this host → deploy: pocket-id
Or build the self-contained artifact and run it on the host:
./build.sh # embeds files into deploy.sh
scp deploy.sh root@host: # copy to the target
ssh root@host 'bash deploy.sh' # interactive
# non-interactive:
# POCKETID_DOMAIN=id.example.com ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
Unattended provisioning: cloud-init.yml.
DNS for POCKETID_DOMAIN must resolve to the host and ports 80/443 be
reachable before deploy, or the LE cert request fails.