From 56fb1fc9807ad5aeba428a19762796688c80c8b5 Mon Sep 17 00:00:00 2001
From: Joe Mou <dev@mou.fo>
Date: Thu, 2 Jul 2026 00:20:01 -0400
Subject: Upgrade to NixOS 26.05

---
 hostnix/elmo/oidc.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'hostnix/elmo/oidc.nix')

diff --git a/hostnix/elmo/oidc.nix b/hostnix/elmo/oidc.nix
index 40a0528..ebdd19a 100644
--- a/hostnix/elmo/oidc.nix
+++ b/hostnix/elmo/oidc.nix
@@ -11,6 +11,7 @@
   #   - PKCE
   services.pocket-id = {
     enable = true;
+    credentials.ENCRYPTION_KEY = "/var/secrets/pocket-id.key";
     settings = {
       APP_URL = "https://pi.mou.fo";
       TRUST_PROXY = true;
@@ -46,6 +47,7 @@
     nginx.domain = "op.mou.fo";
     setXauthrequest = true; # let oauth2-proxy nginx module pass X-User/X-Email
     reverseProxy = true;
+    trustedProxyIP = [ "127.0.0.1" ];
     provider = "oidc";
     clientID = "39edd929-8983-4cb6-b1cd-dc08e2e3358f";
     oidcIssuerUrl = "https://pi.mou.fo";
@@ -56,6 +58,7 @@
     extraConfig = {
       code-challenge-method = "S256";
       whitelist-domain = ".mou.fo"; # allowed redirects after authentication
+      insecure-oidc-allow-unverified-email = true;
     };
   };
 
-- 
cgit v1.3.1