Add Pocket ID as a passkey login provider at id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/Caddyfile.j2

@@ -2,6 +2,10 @@ auth.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+{{ subdomains.pocketid }} {
+    reverse_proxy pocket-id:1411
+}
+
 paper.thesatelliteoflove.com {
     reverse_proxy paperlessngx-webserver-1:8000
 }

roles/docker/templates/pocketid-compose.yml.j2

@@ -0,0 +1,26 @@
+services:
+  pocket-id:
+    image: ghcr.io/pocket-id/pocket-id:v2
+    container_name: pocket-id
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    labels:
+      glance.name: Pocket ID
+      glance.icon: si:passkey
+      glance.url: https://{{ subdomains.pocketid }}/
+      glance.description: Passkey OIDC provider
+      glance.id: pocketid
+      mag37.dockcheck.update: true
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/pocketid-env.j2

@@ -0,0 +1,5 @@
+APP_URL=https://{{ subdomains.pocketid }}
+ENCRYPTION_KEY={{ vault_pocketid.encryption_key }}
+TRUST_PROXY=true
+PUID=1000
+PGID=1000