panigrc<p><span class="h-card" translate="no"><a href="https://cyberfurz.social/@hack13" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>hack13</span></a></span> I have a <a href="https://mastodon.social/tags/wireguard" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>wireguard</span></a> entrypoint in a <a href="https://mastodon.social/tags/vps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vps</span></a> and connect through it to my <a href="https://mastodon.social/tags/homeserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homeserver</span></a> <br>Currently have:<br><a href="https://mastodon.social/tags/pihole" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pihole</span></a><br><a href="https://mastodon.social/tags/homeassistant" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homeassistant</span></a><br><a href="https://mastodon.social/tags/esphome" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>esphome</span></a><br><a href="https://mastodon.social/tags/mstream" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mstream</span></a><br><a href="https://mastodon.social/tags/gonic" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gonic</span></a><br><a href="https://mastodon.social/tags/WoodpeckerCI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WoodpeckerCI</span></a> worker</p><p>And <a href="https://mastodon.social/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>caddy</span></a> as reverse proxy</p><p><a href="https://mastodon.social/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homelab</span></a> <a href="https://mastodon.social/tags/selfhost" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selfhost</span></a> <a href="https://mastodon.social/tags/selfhosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selfhosted</span></a></p>
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome
Administered by:
Server stats:
4.7Kactive users
techhub.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.1
#caddy
3 posts · 3 participants · 0 posts today
Lucas Janin 🇨🇦🇫🇷<p><span class="h-card" translate="no"><a href="https://kolektiva.social/@rae" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rae</span></a></span> This is the way! </p><p>My setup is very similar to your plan. I have 4 VMs on my public VLAN: <a href="https://mastodon.social/tags/Headscale" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Headscale</span></a>, <a href="https://mastodon.social/tags/PocketID" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PocketID</span></a>, Podsync and <a href="https://mastodon.social/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> as a reverse proxy. </p><p>Like your plan, all my other services are only accessible via <a href="https://mastodon.social/tags/Tailscale" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tailscale</span></a>. So, I cut the Tailscale server dependency</p>
Ivan Agosto 🇲🇽<p><a href="https://mast.lat/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> funciona muy bien si estas pensando autoalojar servicios. Es un server que puede funcionar de proxy inverso (para eso lo uso).</p><p>Hoy configure Caddy para que muestre un mensaje cuando mi blog este caido como hoy que se fue la luz.</p><p>Si aun no sabes que es caddy te dejo su sitio oficial:<br><a href="https://caddyserver.com/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">caddyserver.com/</span><span class="invisible"></span></a></p>
Martin Boller :debian: :tux: :freebsd: :windows: :mastodon:<p>Another short blog post on blocking <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/LLM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LLM</span></a> <a href="https://infosec.exchange/tags/Bots" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bots</span></a> that slow down a website. Using <a href="https://infosec.exchange/tags/NGINX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NGINX</span></a>, but easily adaptable to <a href="https://infosec.exchange/tags/ApacheWebServer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ApacheWebServer</span></a> <a href="https://infosec.exchange/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> etc</p><p><a href="https://www.infosecworrier.dk/blog/2025/07/botblocker/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">infosecworrier.dk/blog/2025/07</span><span class="invisible">/botblocker/</span></a></p>
Gea-Suan Lin<p><a href="https://blog.gslin.org/archives/2025/07/04/12498/caddy-%e4%b8%8a%e7%94%a8-dnsbl-%e6%93%8b-bot/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.gslin.org/archives/2025/0</span><span class="invisible">7/04/12498/caddy-%e4%b8%8a%e7%94%a8-dnsbl-%e6%93%8b-bot/</span></a></p><p>Caddy 上用 DNSBL 擋 bot</p><p><a href="https://abpe.org/tags/address" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>address</span></a> <a href="https://abpe.org/tags/ai" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ai</span></a> <a href="https://abpe.org/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bot</span></a> <a href="https://abpe.org/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>caddy</span></a> <a href="https://abpe.org/tags/dnsbl" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dnsbl</span></a> <a href="https://abpe.org/tags/ip" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ip</span></a> <a href="https://abpe.org/tags/proxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>proxy</span></a> <a href="https://abpe.org/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>spam</span></a> <a href="https://abpe.org/tags/wiki" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>wiki</span></a></p>
Uckermark MacGyver :nonazi:<p>Switched this server to my new <a href="https://hub.uckermark.social/tags/Hetzner" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Hetzner</span></a> Object Storage backend. Also switched from <a href="https://hub.uckermark.social/tags/NGINX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NGINX</span></a> as reverse proxy to <a href="https://hub.uckermark.social/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a>.</p>
16180339887<p>that's what i used for training-text:<br><br><a href="https://gutenberg.org/cache/epub/4682/pg4682.txt" rel="nofollow noopener" target="_blank">https://gutenberg.org/cache/epub/4682/pg4682.txt</a><br><br>that's the word list:<br><br><a href="https://websites.umich.edu/~jlawler/wordlist" rel="nofollow noopener" target="_blank">https://websites.umich.edu/~jlawler/wordlist</a><br><br>i had so much fun. <span class="h-card"><a href="https://goto.byrd.ws/@joshua" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>joshua</span></a></span> <span class="h-card"><a href="https://goto.byrd.ws/@v__v" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>v__v</span></a></span> you should try this<br><br><a href="https://gts.tuttipazzi.cyou/tags/fckai" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FckAI</span></a> <a href="https://gts.tuttipazzi.cyou/tags/iocaine" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Iocaine</span></a> <a href="https://gts.tuttipazzi.cyou/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> <a href="https://gts.tuttipazzi.cyou/tags/tuttipazzi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TuttiPazzi</span></a></p>
16180339887<p>or maybe i'll try iocaine:<br><br><a href="https://iocaine.madhouse-project.org/howto/fronting-iocaine-with-caddy/" rel="nofollow noopener" target="_blank">https://iocaine.madhouse-project.org/howto/fronting-iocaine-with-caddy/</a><br><br><a href="https://gts.tuttipazzi.cyou/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> <a href="https://gts.tuttipazzi.cyou/tags/iocaine" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Iocaine</span></a> <a href="https://gts.tuttipazzi.cyou/tags/aipoisoning" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIPoisoning</span></a></p>
OpenUEM<p>If you want to deploy OpenUEM with Docker now you have the option to use a <a href="https://mastodon.social/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> container as a reverse proxy included in the compose file <a href="https://openuem.eu/docs/Installation/Server/docker/#3-use-a-reverse-proxy-optional" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">openuem.eu/docs/Installation/S</span><span class="invisible">erver/docker/#3-use-a-reverse-proxy-optional</span></a> Thanks <span class="h-card" translate="no"><a href="https://birdsite.kohl.dev/users/caddyserver" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>caddyserver</span></a></span></p>
Haruka<p>A new article on my <a href="https://mamot.fr/tags/blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blog</span></a>, about installing and configuring <a href="https://mamot.fr/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> the web server I use now instead of Apache and Nginx.<br><a href="https://memcat.eu/2025/caddy" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">memcat.eu/2025/caddy</span><span class="invisible"></span></a></p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@caddy" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>caddy</span></a></span></p>
patpro<p>Hello, I’m hosting a <a href="https://social.patpro.net/tags/vaultwarden" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Vaultwarden</span></a> server behind <a href="https://social.patpro.net/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> 2.10 and made the following test:</p><p>Tuning Caddy to allow only <a href="https://social.patpro.net/tags/pqc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PQC</span></a> curves:</p><pre><code> tls {
curves x25519mlkem768
}
</code></pre><p>Trying to connect with <a href="https://social.patpro.net/tags/firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Firefox</span></a> Mac -> OK<br>Trying to connect with <a href="https://social.patpro.net/tags/bitwarden" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bitwarden</span></a> <a href="https://social.patpro.net/tags/android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>android</span></a> client -> Fail</p><p>Without the <a href="https://social.patpro.net/tags/tls" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TLS</span></a> tuning, the Bitwarden Android client will happily connect to the server.</p><p>Is it a problem with the Bitwarden Android client or with Android, or both?</p>
Lucas Janin 🇨🇦🇫🇷<p>This week I learned to deploy <a href="https://mastodon.social/tags/Crowdsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Crowdsec</span></a> in my <a href="https://mastodon.social/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homelab</span></a>:</p><p>- CrowdSec LAPI on an LXC in my private VLAN <br>- Caddy-bouncer to protect my public servives<br>- CrowdSec-firewall-bouncer-iptables on my 2 <a href="https://mastodon.social/tags/Proxmox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Proxmox</span></a> nodes <br>- CrowdSec agent for all my public VMs and important VMs/LXCs </p><p>Of course, I created an <a href="https://mastodon.social/tags/Ansible" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ansible</span></a> role to deploy the agent on my multiple hosts/VMs/LXCs using a certificate and a custom port, 8080 is a busy port :-)</p><p>Yes, it’s overkill :-)<br><a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://mastodon.social/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selfhosting</span></a> <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.social/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>caddy</span></a></p>
Shane Rogers<p><a href="https://social.lol/tags/Yesterday" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Yesterday</span></a> I was able to get my <a href="https://social.lol/tags/MailcowDockerized" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MailcowDockerized</span></a> box to work behind the <a href="https://social.lol/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> reverse proxy. A lot easier than I anticipated.</p><p>I may have to reconfigure my mobile <a href="https://social.lol/tags/Thunderbird" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Thunderbird</span></a> client - for some reason it's not sending to outlook365, but SoGo does just fine.</p><p><a href="https://social.lol/tags/Today" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Today</span></a> I'm thinking about getting a static site to sit behind that caddy proxy. I'd like to get <a href="https://social.lol/tags/emacs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>emacs</span></a> and <a href="https://social.lol/tags/org" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>org</span></a> working for publishing.</p><p>So far, so good. Slow going.</p>
Bradley Taunt<p>I'm in the process of porting over all OpenBSD related mini-sites to <a href="https://mastodon.bsd.cafe/tags/httpd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>httpd</span></a> running on my TinyKVM VPS.</p><p>All other web projects will be migrated to Alpine <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a>, served through <a href="https://mastodon.bsd.cafe/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> on my other VPS.</p>
Risotto Bias<p>honestly there are probably several sanity/neatness benefits to "/opt/{app/{version}/db.sqlite" </p><p>it's just whether a <a href="https://toot.risottobias.org/tags/caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>caddy</span></a> config reload will still respond to inflight requests or if it'll drop them during a reload.</p><p>and then I guess you could use a shell script to say "if the current caddy config is 3000, the next server should listen on 4000" and build two systemd services (one for evens, one for odds) to let the systemd services fully start (or fully gracefully shut down?)</p>
Thomas Frans 🇺🇦<p>It seems like today, <a href="https://fosstodon.org/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> automatically stopped automatically renewing <a href="https://fosstodon.org/tags/SSL" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SSL</span></a> certificates.</p><p>Yes, you read that correctly. I will now scream into the void.</p><p><a href="https://fosstodon.org/tags/SelfHosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfHosted</span></a> <a href="https://fosstodon.org/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfHosting</span></a> <a href="https://fosstodon.org/tags/HomeServer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HomeServer</span></a></p>
James M. Woodward<p>I know <a href="https://infosec.exchange/tags/Docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Docker</span></a> is THE hot thing these days, but I swear, sometimes is JUST makes my life much more difficult than it needs to be.</p><p>e.g. I have an internal-only service, Zero WAN/Internet access, which will not run without HTTPS/certs as it leans on browser crypto APIs. </p><p>Okay, not unusual, but can I deploy certs to a container easily? Fuuckkkkk no. The tool's creator recommends <a href="https://infosec.exchange/tags/ACME" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ACME</span></a> (<a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LetsEncrypt</span></a> or another tool implementing ACME) but again, no-internet. </p><p>Well, I have an internal <a href="https://infosec.exchange/tags/PKI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PKI</span></a>. Their docs contain a one-liner saying it should use <a href="https://infosec.exchange/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> / <a href="https://infosec.exchange/tags/traefik" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>traefik</span></a> / <a href="https://infosec.exchange/tags/nginx" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nginx</span></a> reverse proxy in that situation. Now, I have to stand up, configure, manage, etc. something else just to drop a cert in front of this thing. It's still not natively encrypted.</p><p>Took me 10 seconds to whip up a cert from my infra and it's gonna take me longer to build something to actually dish it out.</p>
Lucas Janin<p><strong>Pocket-ID: Bare Metal Installation on Debian</strong></p><p>After using PocketID for several months with an LXC installation and Proxmox Helper Scripts, I noticed that the service runs as root. I also learned that a VM installation is more secure than an LXC. This article will guide you on installing Pocket-ID as a non-root service on Debian.</p><p></p><p><strong>Presentation</strong></p><p>First, if you’re not familiar with Pocket-ID, it’s a modern and lightweight OIDC client designed for managing authentication for services like Authentic and Aurelia. Its unique feature is that it exclusively supports passkeys. I use it with several self-hosted services, including Proxmox, Proxmox Backup Server, Komodo, Betszel, Karakeep, and, of course, Headscale/Headplane. For more details, the <a href="https://pocket-id.org" rel="nofollow noopener" target="_blank">official website</a> will surely answer many of your questions. If a Docker installation is more suitable for your environment, I invite you to visit <a href="https://www.blackvoid.club/pocket-id-passkey-oidc-provider" rel="nofollow noopener" target="_blank">BlackVoid’s excellent post</a>. It also details the configuration for using Pocket-ID to connect to Synology DSM.</p><p><strong>Preamble </strong></p><p>Since I’m not short on memory on my Proxmox node and I’m very particular about the security of my home lab, I set about installing a VM. This was laborious, as up to version 0.53, there were two services, numerous dependencies, and required compilations. Despite the many obstacles, I succeeded in my mission! Then, a few hours later, without even having time to savour my small victory, version 1.0 was released. This major revision greatly simplifies things, as it’s an executable. Here is the procedure for a streamlined installation as a service with a non-root user in a Proxmox Debian VM. This procedure should be relatively easy to adapt to other types of configurations. There are many other methods for installing Pocket-ID; I invite you to consult the <a href="https://pocket-id.org/docs/setup/installation" rel="nofollow noopener" target="_blank">installation</a> page on the Pocket-ID website.</p><p><strong>Preparing the VM in Proxmox</strong></p><p>If you are in Proxmox, I invite you to install a Debian VM using the Proxmox Helper Scripts. It is also possible to do this with a lighter Alpine, but I have not yet embarked on this adventure. Choose the advanced mode and adjust for your situation, and change the hostname to “pocketid”.</p><pre><code>bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/vm/debian-vm.sh)"</code></pre><p><strong>QEMU</strong></p><p>It’s a good practice to install the QEMU Guest Agent on your VM. You can follow these steps in the Proxmox console of the VM.</p><p>Update your package list:</p><pre><code>sudo apt update && sudo apt upgrade -y</code></pre><p>Install the Proxmox QEMU Guest Agent package:</p><pre><code>sudo apt install qemu-guest-agent -y</code></pre><p>Start and enable the service:</p><pre><code>sudo systemctl start qemu-guest-agentsudo systemctl enable emu-guest-agent</code></pre><p>Verify that the service is running:</p><pre><code>sudo systemctl status qemu-guest-agent</code></pre><p>This will ensure that the Proxmox QEMU Guest Agent is successfully installed and running on your Debian system.</p><p><strong>Installing Pocket-ID<br></strong></p><p>Get Debian ready</p><pre><code>apt update && apt upgrade -y</code></pre><p>Create a dedicated user</p><pre><code>useradd -r -s /bin/false -m -d /opt/pocket-id pocketid</code></pre><p>Install curl needed for the installation</p><pre><code>apt install -y curl</code></pre><p>Downloading and Installing Pocket-ID</p><pre><code>cd /opt/pocket-idARCH="amd64"LATEST_RELEASE_URL=$(curl -s https://api.github.com/repos/pocket-id/pocket-id/releases/latest | grep "browser_download_url.*pocket-id-linux-${ARCH}" | cut -d '"' -f 4)sudo curl -L -o pocket-id "${LATEST_RELEASE_URL}"sudo chmod +x pocket-idsudo chown pocketid:pocketid pocket-id</code></pre><p>Creating directories for Pocket-ID data</p><pre><code>sudo mkdir -p /opt/pocket-id/data/uploads</code></pre><p>Pocket-ID configuration file. To locate visitors’ IP addresses, I invite you to create an API key on the <a href="https://support.maxmind.com/hc/en-us/articles/4407111582235-Generate-a-License-Key" class="" rel="nofollow noopener" target="_blank">Maxmind</a> website.</p><pre><code>sudo nano /opt/pocket-id/.env</code></pre><pre><code>APP_URL=https://id.xxxx.xxPORT=1411# Database: SQLite, file located at /opt/pocket-id/data/db.sqlite# (relative to WorkingDirectory=/opt/pocket-id)DB_CONNECTION_STRING=file:data/db.sqlite?_journal_mode=WAL&_busy_timeout=2500&_txlock=immediate# Optional: Maxmind License Key for IP GeolocationMAXMIND_LICENSE_KEY="YOUR-MAXMIND-LICENSE-KEY"# Optional: Logging level (debug, info, warn, error)LOG_LEVEL=info</code></pre><p>Make sure all Pocket-ID files have the correct user permissions.</p><pre><code>sudo chown pocketid:pocketid /opt/pocket-id/.envsudo chmod 600 /opt/pocket-id/.env</code></pre><p>Setting up the Pocket-ID service</p><pre><code>sudo nano /etc/systemd/system/pocketid.service</code></pre><pre><code>[Unit]Description=Pocket ID Application ServerAfter=network.target[Service]Type=simpleUser=pocketidGroup=pocketidWorkingDirectory=/opt/pocket-idExecStart=/opt/pocket-id/pocket-idEnvironmentFile=/opt/pocket-id/.envRestart=alwaysRestartSec=10NoNewPrivileges=truePrivateTmp=true[Install]WantedBy=multi-user.target</code></pre><pre><code>sudo systemctl daemon-reloadsudo systemctl enable pocketid.servicesudo systemctl start pocketid.servicesudo systemctl status pocketid.service</code></pre><p>If everything goes as planned, you should receive a confirmation.</p><pre><code>● pocketid.service - Pocket ID Application Server Loaded: loaded (/etc/systemd/system/pocketid.service; enabled; preset: enabled) Active: active (running) since Sun 2025-06-01 07:12:57 EDT; 7s ago Main PID: 28699 (pocket-id) Tasks: 8 (limit: 2309) Memory: 8.7M CPU: 65ms CGroup: /system.slice/pocketid.service └─28699 /opt/pocket-id/pocket-idJun 01 07:12:57 pocketid systemd[1]: Started pocketid.service - Pocket ID Application Server.Jun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 Starting job schedulerJun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 Server listening on 0.0.0.0:1411Jun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 GeoLite2 City database is up-to-dateJun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 Job "UpdateGeoLiteDB" run successfullyJun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 Job "SyncLdap" run successfullyJun 01 07:12:57 pocketid pocket-id[28699]: 2025/06/01 07:12:57 Job "SendHeartbeat" run successfully</code></pre><p><strong>Caddy Reverse Proxy</strong></p><p>Here is my Caddyfile with the /robots.txt file in case it is respected (it’s nice to dream).</p><pre><code># Snippet for robots.txt(common_robots_txt) {handle /robots.txt {# Set the Content-Type headerheader Content-Type "text/plain; charset=utf-8"# Respond with the body and status code 200respond `User-agent: *Disallow: /` 200}}# Pocket-IDid.xxxx.xx {import common_robots_txt# Fallback to reverse proxy for other requestsreverse_proxy 192.168.x.yyy:1411 [xxxx:xxxx:xxxx:xxxx::yyyy]:1411}</code></pre><pre><code>systemctl reload caddy.service </code></pre><p>For the first setup of your Pocket-ID instance, I invite you to create your administrator account at<a href="https://id.xxxx.xx/login/setup." rel="nofollow noopener" target="_blank"> <code>https://id.xxxx.xx/login/setup</code>.</a>It is strongly encouraged to have two passkeys since this is the only way to authenticate. I have one in Bitwarden/Vaultwarden and another in iCloud Keychain (via Safari).</p><p><strong>Update</strong></p><p>Since we’re not using Docker, updating can be a bit more complicated. However, it’s nothing insurmountable, especially since version 1.0 is already compiled. Here’s a small update script that allowed me to move from version 1.0 to 1.1.0 without a hitch.</p><pre><code>nano /root/update-pocketid.sh</code></pre><pre><code>#!/bin/bash# update-pocketid.sh# --- Configuration ---INSTALL_DIR="/opt/pocket-id"SERVICE_NAME="pocketid.service"USER="pocketid"GROUP="pocketid"VERSION_FILE="${INSTALL_DIR}/version.txt" ARCHITECTURE="amd64" # Change if needed (e.g., arm64)# --- End Configuration ---echo "Checking for the latest version of PocketID..."LATEST_TAG_JSON=$(curl -s https://api.github.com/repos/pocket-id/pocket-id/releases/latest)LATEST_TAG=$(echo "$LATEST_TAG_JSON" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/') # Version without 'v'LATEST_TAG_WITH_V=$(echo "$LATEST_TAG_JSON" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') # Version with 'v'if [ -z "$LATEST_TAG" ]; then echo "Could not retrieve the latest version from GitHub." exit 1fiecho "Latest version available: v${LATEST_TAG}"CURRENT_VERSION="0" # Default to 0 if no version fileif [ -f "$VERSION_FILE" ]; then CURRENT_VERSION=$(cat "$VERSION_FILE")fiecho "Currently installed version: v${CURRENT_VERSION}"if [ "$LATEST_TAG" = "$CURRENT_VERSION" ]; then echo "PocketID is already up to date (v${CURRENT_VERSION})." exit 0fiecho "New version v${LATEST_TAG} available. Updating..."DOWNLOAD_URL=$(echo "$LATEST_TAG_JSON" | grep -E "browser_download_url.*pocket-id-linux-${ARCHITECTURE}" | cut -d '"' -f 4)if [ -z "$DOWNLOAD_URL" ]; then echo "Could not find the download URL for linux-${ARCHITECTURE} and version v${LATEST_TAG}." exit 1fiecho "Stopping service ${SERVICE_NAME}..."sudo systemctl stop "${SERVICE_NAME}"echo "Backing up the old binary..."BACKUP_NAME="pocket-id_backup_v${CURRENT_VERSION}_$(date +%Y%m%d_%H%M%S)"sudo cp "${INSTALL_DIR}/pocket-id" "${INSTALL_DIR}/${BACKUP_NAME}"echo "Old binary backed up to ${INSTALL_DIR}/${BACKUP_NAME}"</code></pre><p>Make the script executable</p><pre><code>sudo chmod +x /root/update-pocketid.sh</code></pre><p>Create an alias</p><pre><code>alias update='/root/update-pocketid.sh'</code></pre><p>Consider updating the system before updating Pocket-ID.</p><pre><code>sudo apt update && sudo apt upgrade -y</code></pre><p>If you are using Proxmox, I encourage you to take a snapshot just before the update and have regular backups (you never know :-).</p><p><strong>Conclusion</strong></p><p>Now, you are ready to step into the future with OIDC and Passkey. You can visit the <a href="https://pocket-id.org/docs/client-examples" rel="nofollow noopener" target="_blank">Client Examples</a> page to easily configure your services with Pocket-ID. I wish you a safe journey into the exciting world of self-hosting!</p><p></p>
Adam ♿<p>If I don't want to use <a href="https://aus.social/tags/Ansible" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ansible</span></a> and I'll only use <a href="https://aus.social/tags/Terraform" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Terraform</span></a> if I'm being paid to, what are my other options if I want to say, deploy <a href="https://aus.social/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a> plus some kind of Fedi server and have it repeatable?</p><p>It looks like Jet was an alternative but the creator ran out of steam.</p><p><a href="https://aus.social/tags/AskFedi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AskFedi</span></a></p><p>[I realise I am basically asking for <a href="https://aus.social/tags/Docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Docker</span></a> but I would like to try something else]</p>
Thomas Frans 🇺🇦<p>Having a home server is so much fun. Can't scan because the scanning software doesn't run on <a href="https://fosstodon.org/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a>? No problem, just set up the scanner to upload over SFTP to your server and serve the files using <a href="https://fosstodon.org/tags/Caddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Caddy</span></a>!</p><p>I love this!</p><p><a href="https://fosstodon.org/tags/SelfHost" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfHost</span></a> <a href="https://fosstodon.org/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfHosting</span></a> <a href="https://fosstodon.org/tags/SelfHosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfHosted</span></a> <a href="https://fosstodon.org/tags/HomeServer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HomeServer</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload