Add Pocket ID as a passkey login provider at id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/all/domains.yml

@@ -29,6 +29,7 @@ subdomains:
   dir2opds: "opds.{{ primary_domain }}"  # dir2opds OPDS catalog
   kosync: "sync.{{ primary_domain }}"  # KOReader sync server
   gokapi: "gokapi.{{ primary_domain }}"  # Gokapi file sharing
+  pocketid: "id.{{ primary_domain }}"  # Pocket ID passkey OIDC
 
 # Email domains for notifications
 email_domains:

roles/docker/tasks/infrastructure/main.yml

@@ -9,6 +9,10 @@
   import_tasks: authentik.yml
   tags: authentik
 
+- name: Install pocketid
+  import_tasks: pocketid.yml
+  tags: pocketid
+
 - name: Deploy dockge stack
   community.docker.docker_compose_v2:
     project_src: /opt/dockge

roles/docker/tasks/infrastructure/pocketid.yml

@@ -0,0 +1,28 @@
+- name: make pocketid directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/pocketid
+
+- name: Template out the pocketid compose file
+  ansible.builtin.template:
+    src: pocketid-compose.yml.j2
+    dest: /opt/stacks/pocketid/compose.yml
+    owner: root
+    mode: '0644'
+
+- name: Template out the pocketid .env file
+  ansible.builtin.template:
+    src: pocketid-env.j2
+    dest: /opt/stacks/pocketid/.env
+    owner: root
+    mode: '0640'
+    group: docker
+  diff: false  # contains the encryption key
+
+- name: deploy pocketid stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/pocketid
+    files:
+    - compose.yml

roles/docker/templates/Caddyfile.j2

@@ -2,6 +2,10 @@ auth.thesatelliteoflove.com {
     reverse_proxy authentik-server-1:9000
 }
 
+{{ subdomains.pocketid }} {
+    reverse_proxy pocket-id:1411
+}
+
 paper.thesatelliteoflove.com {
     reverse_proxy paperlessngx-webserver-1:8000
 }

roles/docker/templates/pocketid-compose.yml.j2

@@ -0,0 +1,26 @@
+services:
+  pocket-id:
+    image: ghcr.io/pocket-id/pocket-id:v2
+    container_name: pocket-id
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    labels:
+      glance.name: Pocket ID
+      glance.icon: si:passkey
+      glance.url: https://{{ subdomains.pocketid }}/
+      glance.description: Passkey OIDC provider
+      glance.id: pocketid
+      mag37.dockcheck.update: true
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}

roles/docker/templates/pocketid-env.j2

@@ -0,0 +1,5 @@
+APP_URL=https://{{ subdomains.pocketid }}
+ENCRYPTION_KEY={{ vault_pocketid.encryption_key }}
+TRUST_PROXY=true
+PUID=1000
+PGID=1000