Headscale

Create the client in Pocket ID

1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
2. Enter a name such as Headscale and add the callback URL https://headscale.example.com/oidc/callback.
3. Click Create and copy the Client ID and the Client secret. The client secret is only shown once.
4. On the client’s General tab, turn on PKCE, then click Save.
5. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure Headscale

Note

Refer to the example config.yaml for full OIDC configuration options.

Add the following to config.yaml:

oidc:
  issuer: 'https://id.example.com'
  client_id: '<client-id>'
  client_secret: '<client-secret>'
  pkce:
    enabled: true
    method: S256

Restrict access to certain groups

(Optional) To allow only specific groups, add the following under oidc::

oidc:
  scope: ['openid', 'profile', 'email', 'groups']
  allowed_groups:
    - <POCKET-ID-GROUP-NAME> # example: headscale