Yay!
-
@jwildeboer @homelab What exactly do you mean by „map the host CA certificates into containers“? I don’t want to answer a question you did not ask
@lennybacon As I use my own CA, I have added my CA root to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem on all my servers. Now I want to be sure my containers use that one, so TLS verification works. @homelab
-
I know some of you are waiting for a blog post or gist on how I do it, but I first need to solve a few problems, mainly on how to get PocketID on a separate virtual network so that name resolution and connections work between the various containers on the same machine. Also: how to map the host CA certificates into the containers. If you know, how to do this with #podman please share, so that I can learn! Stay tuned
@jwildeboer
Can you mount the host certs and shadow whatever is in the containers? Should work and reduce CA distribution to the hosts only.
I am just (very slowly) rolling out Lego(CLI) + a push job to move LE certs around. Once this is done I'll be dealing with vault and the same problem.CA is kind of easy to fix on the incus system containers via terraform. Container apps I manage through lazy ansible and my plan was to do it by mounting the lab CA. On k8s we just roll out configmaps and mount them in the pods. Slightly tempted to redeploy kubernetes at home just for things like that ..
@homelab -
@jwildeboer
Can you mount the host certs and shadow whatever is in the containers? Should work and reduce CA distribution to the hosts only.
I am just (very slowly) rolling out Lego(CLI) + a push job to move LE certs around. Once this is done I'll be dealing with vault and the same problem.CA is kind of easy to fix on the incus system containers via terraform. Container apps I manage through lazy ansible and my plan was to do it by mounting the lab CA. On k8s we just roll out configmaps and mount them in the pods. Slightly tempted to redeploy kubernetes at home just for things like that ..
@homelab -
-
I know some of you are waiting for a blog post or gist on how I do it, but I first need to solve a few problems, mainly on how to get PocketID on a separate virtual network so that name resolution and connections work between the various containers on the same machine. Also: how to map the host CA certificates into the containers. If you know, how to do this with #podman please share, so that I can learn! Stay tuned
And solved! After adding the correct mapping and environment variable to the immich-server quadlet file, I can now login to immich using a passkey via PocketID!
-
@jwildeboer @homelab TLS by the way, but why not also blog this?
-
@jwildeboer @homelab TLS by the way, but why not also blog this?
@ramonfincken See the post I made immediately before: https://social.wildeboer.net/@jwildeboer/117217341135131860 Now that it works and I understand why, I can start working on that blog post. I am just a slow human being and it's the weekend, so please allow me a few hours to get it all done
@homelab -
@ramonfincken See the post I made immediately before: https://social.wildeboer.net/@jwildeboer/117217341135131860 Now that it works and I understand why, I can start working on that blog post. I am just a slow human being and it's the weekend, so please allow me a few hours to get it all done
@homelab@jwildeboer @homelab super ! It will have more reach
-
Yay! PocketID [1] is up and running in my homelab. Runs as a quadlet service container under podman behind a nginx reverse proxy, with its own SSL cert, generated by my own CA. Passkeys in the #Homelab!
[1] https://pocket-id.org "The most user-friendly OpenID Connect Certified
and OAuth 2.0 provider that lets users sign in to your applications with passkeys."@jwildeboer I struggled for quite a while to get it up and running on my TrueNAS, but when I finally understood the concepts and got everything right it was a great addition.
-
@jwildeboer
I'm not sure im reading that right, but since I just spent a bit of time redoing DNS at home: having two DNS servers and DHCP in the mix I found out that hostnames do not resolve if I ask "the wrong one". Might just be the same thing or not at all, worth the toot.
So in the end I completely gave up on using hostnames, and instead im doing split horizon DNS and assigning one A/AAAA record e.g. <name>.host.my.tld for every metal or virtual machine. A bit more annoying to type but hey. Once I got my zones and authorative servers right all my problems went away.
-
Yay! PocketID [1] is up and running in my homelab. Runs as a quadlet service container under podman behind a nginx reverse proxy, with its own SSL cert, generated by my own CA. Passkeys in the #Homelab!
[1] https://pocket-id.org "The most user-friendly OpenID Connect Certified
and OAuth 2.0 provider that lets users sign in to your applications with passkeys."@{jwildeboer@social.wildeboer.net} if we all used openid and rss/atom readers, we may have not needed protocols like diaspora or activity pub.
subscribe/read by rss/atom, comment with openid.
-
Yay! PocketID [1] is up and running in my homelab. Runs as a quadlet service container under podman behind a nginx reverse proxy, with its own SSL cert, generated by my own CA. Passkeys in the #Homelab!
[1] https://pocket-id.org "The most user-friendly OpenID Connect Certified
and OAuth 2.0 provider that lets users sign in to your applications with passkeys."@jwildeboer @homelab I also have #PocketID running in my homelab also with my own CA (#stepca) but using a #caddy reverse proxy.
If you also need/want SSH key provisioning (amongst other things) I can recommend #kanidm
It doesn't offer a fancy admin web interface like PocketID, though. There is a minimal one for users - for admins there is a powerful CLI.
-
M mjack@mastodon.bsd.cafe shared this topic
M mjack@mastodon.bsd.cafe shared this topic
