From 206dbcb15158e7d5a4c5d00bf3394f92e75e192a Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Fri, 30 Oct 2026 08:39:46 -0600
Subject: [PATCH] Add Pocket ID as a passkey login provider at
 id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 group_vars/all/domains.yml                    |  1 +
 roles/docker/tasks/infrastructure/main.yml    |  4 +++
 .../docker/tasks/infrastructure/pocketid.yml  | 28 +++++++++++++++++++
 roles/docker/templates/Caddyfile.j2           |  4 +++
 .../docker/templates/pocketid-compose.yml.j2  | 26 +++++++++++++++++
 roles/docker/templates/pocketid-env.j2        |  5 ++++
 6 files changed, 68 insertions(+)
 create mode 100644 roles/docker/tasks/infrastructure/pocketid.yml
 create mode 100644 roles/docker/templates/pocketid-compose.yml.j2
 create mode 100644 roles/docker/templates/pocketid-env.j2

diff --git a/group_vars/all/domains.yml b/group_vars/all/domains.yml
index d1a8f9c..d684f74 100644
--- a/group_vars/all/domains.yml
+++ b/group_vars/all/domains.yml
@@ -29,6 +29,7 @@ subdomains:
   dir2opds: "opds.{{ primary_domain }}"  # dir2opds OPDS catalog
   kosync: "sync.{{ primary_domain }}"  # KOReader sync server
   gokapi: "gokapi.{{ primary_domain }}"  # Gokapi file sharing
+  pocketid: "id.{{ primary_domain }}"  # Pocket ID passkey OIDC
 
 # Email domains for notifications
 email_domains:
diff --git a/roles/docker/tasks/infrastructure/main.yml b/roles/docker/tasks/infrastructure/main.yml
index b340b6c..16b5d8e 100644
--- a/roles/docker/tasks/infrastructure/main.yml
+++ b/roles/docker/tasks/infrastructure/main.yml
@@ -9,6 +9,10 @@
   import_tasks: authentik.yml
   tags: authentik
 
+- name: Install pocketid
+  import_tasks: pocketid.yml
+  tags: pocketid
+
 - name: Deploy dockge stack
   community.docker.docker_compose_v2:
     project_src: /opt/dockge
diff --git a/roles/docker/tasks/infrastructure/pocketid.yml b/roles/docker/tasks/infrastructure/pocketid.yml
new file mode 100644
index 0000000..a526c5c
--- /dev/null
+++ b/roles/docker/tasks/infrastructure/pocketid.yml
@@ -0,0 +1,28 @@
+- name: make pocketid directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/pocketid
+
+- name: Template out the pocketid compose file
+  ansible.builtin.template:
+    src: pocketid-compose.yml.j2
+    dest: /opt/stacks/pocketid/compose.yml
+    owner: root
+    mode: '0644'
+
+- name: Template out the pocketid .env file
+  ansible.builtin.template:
+    src: pocketid-env.j2
+    dest: /opt/stacks/pocketid/.env
+    owner: root
+    mode: '0640'
+    group: docker
+  diff: false  # contains the encryption key
+
+- name: deploy pocketid stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/pocketid
+    files:
+    - compose.yml
diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index 5f57e77..b324cf2 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -2,6 +2,10 @@ auth.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+{{ subdomains.pocketid }} {
+    reverse_proxy pocket-id:1411
+}
+
 paper.thesatelliteoflove.com {
     reverse_proxy paperlessngx-webserver-1:8000
 }
diff --git a/roles/docker/templates/pocketid-compose.yml.j2 b/roles/docker/templates/pocketid-compose.yml.j2
new file mode 100644
index 0000000..7441083
--- /dev/null
+++ b/roles/docker/templates/pocketid-compose.yml.j2
@@ -0,0 +1,26 @@
+services:
+  pocket-id:
+    image: ghcr.io/pocket-id/pocket-id:v2
+    container_name: pocket-id
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    labels:
+      glance.name: Pocket ID
+      glance.icon: si:passkey
+      glance.url: https://{{ subdomains.pocketid }}/
+      glance.description: Passkey OIDC provider
+      glance.id: pocketid
+      mag37.dockcheck.update: true
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}
diff --git a/roles/docker/templates/pocketid-env.j2 b/roles/docker/templates/pocketid-env.j2
new file mode 100644
index 0000000..d19ab24
--- /dev/null
+++ b/roles/docker/templates/pocketid-env.j2
@@ -0,0 +1,5 @@
+APP_URL=https://{{ subdomains.pocketid }}
+ENCRYPTION_KEY={{ vault_pocketid.encryption_key }}
+TRUST_PROXY=true
+PUID=1000
+PGID=1000