<![CDATA[Yay!]]>Yay! PocketID [1] is up and running in my homelab. Runs as a quadlet service container under podman behind a nginx reverse proxy, with its own SSL cert, generated by my own CA. Passkeys in the !

[1] https://pocket-id.org "The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys."

@homelab

]]>https://forum.fedi.dk/topic/af818bda-cc32-4692-bd7f-15a004c308b8/yayRSS for NodeFri, 11 Sep 2026 21:16:21 GMTFri, 04 Sep 2026 14:37:25 GMT60<![CDATA[Reply to Yay! on Wed, 09 Sep 2026 15:34:45 GMT]]>@jwildeboer @homelab I also have running in my homelab also with my own CA (#stepca) but using a reverse proxy.

If you also need/want SSH key provisioning (amongst other things) I can recommend

It doesn't offer a fancy admin web interface like PocketID, though. There is a minimal one for users - for admins there is a powerful CLI.

https://kanidm.github.io/

]]>https://forum.fedi.dk/post/https://fedifreu.de/ap/users/115895439005760263/statuses/117241812439557675https://forum.fedi.dk/post/https://fedifreu.de/ap/users/115895439005760263/statuses/117241812439557675Wed, 09 Sep 2026 15:34:45 GMT<![CDATA[Reply to Yay! on Tue, 08 Sep 2026 19:24:44 GMT]]>@{jwildeboer@social.wildeboer.net} if we all used openid and rss/atom readers, we may have not needed protocols like diaspora or activity pub.

subscribe/read by rss/atom, comment with openid.

]]>https://forum.fedi.dk/post/https://xn--y9azesw6bu.xn--y9a3aq/content/a3c51187-6401-48b6-99e0-42489359e6d5/https://forum.fedi.dk/post/https://xn--y9azesw6bu.xn--y9a3aq/content/a3c51187-6401-48b6-99e0-42489359e6d5/Tue, 08 Sep 2026 19:24:44 GMT<![CDATA[Reply to Yay! on Mon, 07 Sep 2026 17:07:52 GMT]]>@jwildeboer
I'm not sure im reading that right, but since I just spent a bit of time redoing DNS at home: having two DNS servers and DHCP in the mix I found out that hostnames do not resolve if I ask "the wrong one". Might just be the same thing or not at all, worth the toot.

So in the end I completely gave up on using hostnames, and instead im doing split horizon DNS and assigning one A/AAAA record e.g. <name>.host.my.tld for every metal or virtual machine. A bit more annoying to type but hey. Once I got my zones and authorative servers right all my problems went away.

@homelab

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117230853993529208https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117230853993529208Mon, 07 Sep 2026 17:07:52 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 17:39:00 GMT]]>@jwildeboer I struggled for quite a while to get it up and running on my TrueNAS, but when I finally understood the concepts and got everything right it was a great addition.

]]>https://forum.fedi.dk/post/https://thoresson.social/users/anders/statuses/117219651766079064https://forum.fedi.dk/post/https://thoresson.social/users/anders/statuses/117219651766079064Sat, 05 Sep 2026 17:39:00 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:55:44 GMT]]>@jwildeboer @homelab super ! It will have more reach

]]>https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219245729758385https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219245729758385Sat, 05 Sep 2026 15:55:44 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:44:05 GMT]]>@ramonfincken See the post I made immediately before: https://social.wildeboer.net/@jwildeboer/117217341135131860 Now that it works and I understand why, I can start working on that blog post. I am just a slow human being and it's the weekend, so please allow me a few hours to get it all done 🙂 @homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117219199909129564https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117219199909129564Sat, 05 Sep 2026 15:44:05 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:41:47 GMT]]>@jwildeboer @homelab TLS by the way, but why not also blog this?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219190850423196https://forum.fedi.dk/post/https://mastodon.social/users/ramonfincken/statuses/117219190850423196Sat, 05 Sep 2026 15:41:47 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 15:35:22 GMT]]>And solved! After adding the correct mapping and environment variable to the immich-server quadlet file, I can now login to immich using a passkey via PocketID!

@homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117219165629401783https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117219165629401783Sat, 05 Sep 2026 15:35:22 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 13:34:53 GMT]]>@bmarinov What still seems to fail is name resolution. My immich-server container seems unable to get to my PocketID container using its hostname sos.homelab.jhw @homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218691848325058https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218691848325058Sat, 05 Sep 2026 13:34:53 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 13:15:15 GMT]]>@bmarinov Yes, I tried that. And also making sure with "setsebool -P container_read_certs 1" that SELinux stays happy. I also note that there seems to be a "--import-native-ca" flag in podman but I am not sure how to add that to a quadlet file. @homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218614679565012https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218614679565012Sat, 05 Sep 2026 13:15:15 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 12:56:29 GMT]]>@jwildeboer
Can you mount the host certs and shadow whatever is in the containers? Should work and reduce CA distribution to the hosts only.
I am just (very slowly) rolling out Lego(CLI) + a push job to move LE certs around. Once this is done I'll be dealing with vault and the same problem.

CA is kind of easy to fix on the incus system containers via terraform. Container apps I manage through lazy ansible and my plan was to do it by mounting the lab CA. On k8s we just roll out configmaps and mount them in the pods. Slightly tempted to redeploy kubernetes at home just for things like that ..
@homelab

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117218540864023266https://forum.fedi.dk/post/https://hachyderm.io/users/bmarinov/statuses/117218540864023266Sat, 05 Sep 2026 12:56:29 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 12:15:58 GMT]]>@lennybacon As I use my own CA, I have added my CA root to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem on all my servers. Now I want to be sure my containers use that one, so TLS verification works. @homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218381582524697https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117218381582524697Sat, 05 Sep 2026 12:15:58 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 11:32:40 GMT]]>@jwildeboer @homelab What exactly do you mean by „map the host CA certificates into containers“? I don’t want to answer a question you did not ask 🙂

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/lennybacon/statuses/117218211283577763https://forum.fedi.dk/post/https://infosec.exchange/users/lennybacon/statuses/117218211283577763Sat, 05 Sep 2026 11:32:40 GMT<![CDATA[Reply to Yay! on Sat, 05 Sep 2026 07:51:22 GMT]]>I know some of you are waiting for a blog post or gist on how I do it, but I first need to solve a few problems, mainly on how to get PocketID on a separate virtual network so that name resolution and connections work between the various containers on the same machine. Also: how to map the host CA certificates into the containers. If you know, how to do this with please share, so that I can learn! Stay tuned 🙂

@homelab

]]>https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117217341135131860https://forum.fedi.dk/post/https://social.wildeboer.net/users/jwildeboer/statuses/117217341135131860Sat, 05 Sep 2026 07:51:22 GMT<![CDATA[Reply to Yay! on Fri, 04 Sep 2026 15:59:34 GMT]]>@jwildeboer Oh wow, this looks extremely neat. Got to try this out!]]>https://forum.fedi.dk/post/https://shrimp.vijf.life/notes/aqqpeltfx1f1ekk7https://forum.fedi.dk/post/https://shrimp.vijf.life/notes/aqqpeltfx1f1ekk7Fri, 04 Sep 2026 15:59:34 GMT