Nomploy Nomad Packs

← All packs

pocket-id v0.1.0

Identity

Pocket ID — a simple, passkey-first OpenID Connect (OIDC) provider: sign in to your self-hosted apps with WebAuthn passkeys, no passwords. Deployed as a single host-networked Nomad service on SQLite with a data volume. A lightweight alternative to keycloak/authentik for SSO.

nomad-pack run pocket-id --registry nomploy

Source ↗ Project ↗ ★ 9.3k

1 task http 1411 1 volume image ghcr.io/pocket-id/pocket-id:latest
Variables 10
values.hcl

Save as values.hcl, edit, then run:

nomad-pack run pocket-id -f values.hcl --registry nomploy
# The name of the Nomad job.
job_name = "pocket-id"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Pocket ID container image. Pin a tag in production.
image = "ghcr.io/pocket-id/pocket-id:latest"

# Host port for the Pocket ID web UI / OIDC endpoints (PORT).
port = 1411

# Public URL Pocket ID is served at (APP_URL). REQUIRED for passkeys — WebAuthn is origin-bound, so this must be the exact scheme+host+port your browser uses. Empty = http://localhost:<port> (dev only).
app_url = ""

# Trust reverse-proxy headers for the real client IP (TRUST_PROXY).
trust_proxy = false

# Named volume for the SQLite database and keys (/app/data).
data_volume = "pocket_id_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 256
  }
NameTypeDefaultDescription
job_name string 
"pocket-id"
 The name of the Nomad job.
namespace string 
"default"
 The Nomad namespace to deploy into.
datacenters list 
["*"]
 The datacenters to deploy to.
image string 
"ghcr.io/pocket-id/pocket-id:latest"
 The Pocket ID container image. Pin a tag in production.
port number 
1411
 Host port for the Pocket ID web UI / OIDC endpoints (PORT).
app_url string 
""
 Public URL Pocket ID is served at (APP_URL). REQUIRED for passkeys — WebAuthn is origin-bound, so this must be the exact scheme+host+port your browser uses. Empty = http://localhost:<port> (dev only).
trust_proxy bool 
false
 Trust reverse-proxy headers for the real client IP (TRUST_PROXY).
data_volume string 
"pocket_id_data"
 Named volume for the SQLite database and keys (/app/data).
constraints list 
[]
 Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources object 
{
    cpu    = 300
    memory = 256
  }
 The task resources.
Readme

pocket-id

Pocket ID — a simple, passkey-first OpenID Connect (OIDC) provider. Sign in to your self-hosted apps with WebAuthn passkeys, no passwords. A lightweight alternative to the keycloak / authentik packs for SSO.

Single host-networked Nomad service on SQLite with a data volume.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run pocket-id --registry=nomploy

Configure

Variable Default Description
port 1411 Web UI / OIDC port (PORT).
app_url "" Public URL (APP_URL) — required for passkeys; must match the browser origin exactly.
trust_proxy false Trust reverse-proxy headers (TRUST_PROXY).
data_volume pocket_id_data /app/data — SQLite database + keys.
image ghcr.io/pocket-id/pocket-id:latest Image. Pin a tag in production.
resources { cpu = 300, memory = 256 } Task resources.

Passkeys need a secure context. Set app_url to the exact URL your browser uses and serve over HTTPS (WebAuthn only allows localhost over HTTP). Behind a TLS proxy, set app_url to the https:// URL and trust_proxy = true.

Open the URL to create the first admin + passkey, then register OIDC clients. Pin the job to the node holding the volume with constraints.