From 3afd2c435dd7587c6f2d0f8dbea591449919a514 Mon Sep 17 00:00:00 2001
From: Beda Schmid <beda@tukutoi.com>
Date: Tue, 4 Aug 2026 19:10:24 +0000
Subject: [PATCH] Initial commit

---
 .gitignore         | 14 ++++++++++++++
 LICENSE            | 24 ++++++++++++++++++++++++
 README.md          | 27 +++++++++++++++++++++++++++
 docker-compose.yml | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 99 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 LICENSE
 create mode 100644 README.md
 create mode 100644 docker-compose.yml

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..8c2b884
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,14 @@
+# ---> VisualStudioCode
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+!.vscode/*.code-snippets
+
+# Local History for Visual Studio Code
+.history/
+
+# Built Visual Studio Code Extensions
+*.vsix
+
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..efb9808
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org/>
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..b3e1117
--- /dev/null
+++ b/README.md
@@ -0,0 +1,27 @@
+# Pocket ID
+
+Self-hosted OIDC identity provider using passkeys for authentication.
+
+## Deployment layout
+
+- **Compose:** `/srv/docker/pocketid/docker-compose.yml`
+- **Static configuration/source:** none
+- **Non-secret environment:** application URL, trusted-proxy policy, UID, GID, and the encryption-key file location
+are declared inline in Compose; there is no project-local `.env`
+- **Secrets:** `/srv/docker/secrets/pocketid/encryption_key`
+- **NVMe application state:** `/srv/appdata/pocketid/data`
+- **Bulk HDD data:** none
+- **Other mounts:** none
+
+Secrets are never committed to this repository. The central encryption key is
+supplied to the Pocket ID service as the `pocketid_encryption_key` Docker secret
+and referenced through `ENCRYPTION_KEY_FILE`.
+
+## Dependencies and recovery
+
+- **Networks/dependencies:** Pocket ID uses the external `npm_proxy` network at `192.168.100.10`; no dependent
+services are declared
+- **Back up:** `/srv/appdata/pocketid/data` and the separately protected `/srv/docker/secrets/pocketid/
+encryption_key`
+- **Re-creatable:** the Pocket ID container itself; no persistent cache is declared
+
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..f4b30ca
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,34 @@
+services:
+  pocket-id:
+    image: ghcr.io/pocket-id/pocket-id:v2
+    container_name: pocketid
+    restart: unless-stopped
+    #ports:
+     # - 1411:1411
+    environment:
+        ENCRYPTION_KEY_FILE: /run/secrets/pocketid_encryption_key
+        APP_URL: https://auth.yoonect.com
+        TRUST_PROXY: true
+        PUID: 1000
+        PGID: 1000
+
+    secrets:
+      - pocketid_encryption_key
+    volumes:
+      - "/srv/appdata/pocketid/data:/app/data"
+    healthcheck:
+      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    networks:
+      npm_proxy:
+        ipv4_address: 192.168.100.10
+secrets:
+  pocketid_encryption_key:
+    file: /srv/docker/secrets/pocketid/encryption_key
+
+networks:
+  npm_proxy:
+    external: true