<![CDATA[Yay!]]>Yay! PocketID [1] is up and running in my homelab. Runs as a quadlet service container under podman behind a nginx reverse proxy, with its own SSL cert, generated by my own CA. Passkeys in the !

[1] https://pocket-id.org "The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys."

@homelab

]]>https://forum.fedi.dk/topic/3d82a34d-0297-4e71-8c24-3fa19ff5e64a/yayRSS for NodeFri, 11 Sep 2026 21:16:05 GMTFri, 04 Sep 2026 14:37:25 GMT60<![CDATA[Reply to Yay! on Wed, 09 Sep 2026 15:34:45 GMT]]>@jwildeboer @homelab I also have running in my homelab also with my own CA (#stepca) but using a reverse proxy.

If you also need/want SSH key provisioning (amongst other things) I can recommend

It doesn't offer a fancy admin web interface like PocketID, though. There is a minimal one for users - for admins there is a powerful CLI.

https://kanidm.github.io/

]]>https://forum.fedi.dk/post/https://fedifreu.de/ap/users/115895439005760263/statuses/117241812439557675https://forum.fedi.dk/post/https://fedifreu.de/ap/users/115895439005760263/statuses/117241812439557675Wed, 09 Sep 2026 15:34:45 GMT<![CDATA[Reply to Yay! on Tue, 08 Sep 2026 19:24:44 GMT]]>@{jwildeboer@social.wildeboer.net} if we all used openid and rss/atom readers, we may have not needed protocols like diaspora or activity pub.

subscribe/read by rss/atom, comment with openid.

]]>https://forum.fedi.dk/post/https://xn--y9azesw6bu.xn--y9a3aq/content/a3c51187-6401-48b6-99e0-42489359e6d5/https://forum.fedi.dk/post/https://xn--y9azesw6bu.xn--y9a3aq/content/a3c51187-6401-48b6-99e0-42489359e6d5/Tue, 08 Sep 2026 19:24:44 GMT<![CDATA[Reply to Yay! on Mon, 07 Sep 2026 17:07:52 GMT]]>@jwildeboer
I'm not sure im reading that right, but since I just spent a bit of time redoing DNS at home: having two DNS servers and DHCP in the mix I found out that hostnames do not resolve if I ask "the wrong one". Might just be the same thing or not at all, worth the toot.

So in the end I completely gave up on using hostnames, and instead im doing split horizon DNS and assigning one A/AAAA record e.g. <name>.host.my.tld for every metal or virtual machine. A bit more annoying to type but hey. Once I got my zones and authorative servers right all my problems went away.

@homelab

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117230853993529208https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117230853993529208Mon, 07 Sep 2026 17:07:52 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 17:39:00 GMT]]>@jwildeboer I struggled for quite a while to get it up and running on my TrueNAS, but when I finally understood the concepts and got everything right it was a great addition.

]]>https://forum.fedi.dk/post/https://thoresson.social/users/anders/statuses/117219651766079064https://forum.fedi.dk/post/https://thoresson.social/users/anders/statuses/117219651766079064Sat, 05 Sep 2026 17:39:00 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:55:44 GMT]]>@jwildeboer @homelab super ! It will have more reach

]]>https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219245729758385https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219245729758385Sat, 05 Sep 2026 15:55:44 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:41:47 GMT]]>@jwildeboer @homelab TLS by the way, but why not also blog this?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219190850423196https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219190850423196Sat, 05 Sep 2026 15:41:47 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 12:56:29 GMT]]>@jwildeboer
Can you mount the host certs and shadow whatever is in the containers? Should work and reduce CA distribution to the hosts only.
I am just (very slowly) rolling out Lego(CLI) + a push job to move LE certs around. Once this is done I'll be dealing with vault and the same problem.

CA is kind of easy to fix on the incus system containers via terraform. Container apps I manage through lazy ansible and my plan was to do it by mounting the lab CA. On k8s we just roll out configmaps and mount them in the pods. Slightly tempted to redeploy kubernetes at home just for things like that ..
@homelab

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117218540864023266https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117218540864023266Sat, 05 Sep 2026 12:56:29 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 11:32:40 GMT]]>@jwildeboer @homelab What exactly do you mean by „map the host CA certificates into containers“? I don’t want to answer a question you did not ask 🙂

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/lennybacon/statuses/117218211283577763https://forum.fedi.dk/post/https://infosec.exchange/users/lennybacon/statuses/117218211283577763Sat, 05 Sep 2026 11:32:40 GMT<![CDATA[Reply to Yay! on Fri, 04 Sep 2026 15:59:34 GMT]]>@jwildeboer Oh wow, this looks extremely neat. Got to try this out!]]>https://forum.fedi.dk/post/https://shrimp.vijf.life/notes/aqqpeltfx1f1ekk7https://forum.fedi.dk/post/https://shrimp.vijf.life/notes/aqqpeltfx1f1ekk7Fri, 04 Sep 2026 15:59:34 GMT