From b902c0bfb02bf86513c0d99ae71dc441b380b16c Mon Sep 17 00:00:00 2001 From: Phil Date: Sat, 31 Oct 2026 08:25:16 -0600 Subject: [PATCH] Move Karakeep login from Authentik to Pocket ID The first Pocket ID login linked to the existing account by email, then email-based account linking was switched off so only that Pocket ID identity can sign in. The client ID now comes from the vault instead of being written in the template. Co-Authored-By: Claude Opus 5.5 --- roles/docker/templates/hoarder-compose.yml.j2 | 2 +- roles/docker/templates/hoarder-env.j2 | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/docker/templates/hoarder-compose.yml.j2 b/roles/docker/templates/hoarder-compose.yml.j2 index 03e086b..6d1d10e 100644 --- a/roles/docker/templates/hoarder-compose.yml.j2 +++ b/roles/docker/templates/hoarder-compose.yml.j2 @@ -8,7 +8,7 @@ services: env_file: - .env extra_hosts: - - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}' + - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}' - '{{ subdomains.bookmarks }}:{{ docker.hairpin_ip }}' environment: MEILI_ADDR: http://meilisearch:7700 diff --git a/roles/docker/templates/hoarder-env.j2 b/roles/docker/templates/hoarder-env.j2 index f539bfc..1d3933b 100644 --- a/roles/docker/templates/hoarder-env.j2 +++ b/roles/docker/templates/hoarder-env.j2 @@ -3,8 +3,8 @@ NEXTAUTH_SECRET={{ vault_hoarder.nextauth_secret }} MEILI_MASTER_KEY={{ vault_hoarder.meili_master_key }} NEXTAUTH_URL=https://{{ subdomains.bookmarks }} OPENAI_API_KEY={{ vault_infrastructure.openai_api_key }} -OAUTH_CLIENT_SECRET={{ vault_hoarder.oidc.client_secret }} -OAUTH_CLIENT_ID=GTi0QBRH5TiTqZfxfAkYSQVVFouGdlOFMc2sjivN -OAUTH_PROVIDER_NAME=Authentik -OAUTH_WELLKNOWN_URL=https://{{ subdomains.auth }}/application/o/hoarder/.well-known/openid-configuration -OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true \ No newline at end of file +OAUTH_CLIENT_SECRET={{ vault_hoarder.pocketid.client_secret }} +OAUTH_CLIENT_ID={{ vault_hoarder.pocketid.client_id }} +OAUTH_PROVIDER_NAME=Pocket ID +OAUTH_WELLKNOWN_URL=https://{{ subdomains.pocketid }}/.well-known/openid-configuration +OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false \ No newline at end of file