ratlogin #

An OpenID Connect (OIDC) provider that authenticates through AT Protocol OAuth. A Rust port of apenwarr/atlogin with some opinionated changes.

Versioning #

Pre-v1.0.0 releases are unstable and may have breaking changes including claim configuration.

Claims #

These claims are distinct from atlogin's and should be reviewed when migrating.

• sub and groups holds the account's stable DID,
• name and preferred_username is their current handle,
• email and email_verified is forwarded from the transition:email scope.

Install (NixOS) #

{
  inputs.ratlogin.url = "git+https://tangled.org/quilling.dev/ratlogin";

  outputs =
    { nixpkgs, ratlogin, ... }:
    {
      nixosConfigurations.example = nixpkgs.lib.nixosSystem {
        modules = [
          ratlogin.nixosModules.default
          {
            services.ratlogin = {
              enable = true;
              # replace every `example.com` with your domain:
              issuer = "https://ratlogin.example.com";
              # pre-register applications here:
              clients = [
                {
                  id = "headscale";
                  redirectUris = [ "https://headscale.example.com/oidc/callback" ];
                  # optional allowlist for DIDs and handles:
                  allow = [ "did:plc:yourdid" "*.example.com" ];
                  # optional denylist for DIDs and handles:
                  deny = [ "did:plc:deny" "deny.example.com" ];
                }
                {
                  id = "grafana";
                  redirectUris = [ "https://grafana.example.com/login/generic_oauth" ];
                  email = "optional";
                }
              ];
            };
            # example caddy config:
            services.caddy = {
              enable = true;
              virtualHosts."ratlogin.example.com".extraConfig = ''
                reverse_proxy 127.0.0.1:9411
              '';
            };
            # example headscale config:
            services.headscale.settings.oidc = {
              issuer = "https://ratlogin.example.com";
              client_id = "headscale";
              client_secret_path = "/etc/ratlogin/clients/headscale";
              scope = [ "openid" "profile" "groups" ];
              pkce.enabled = true;
            };
            # example grafana config:
            services.grafana.settings."auth.generic_oauth" = {
              enabled = true;
              name = "ratlogin";
              client_id = "grafana";
              client_secret = "$__file{/etc/ratlogin/clients/grafana}";
              auth_url = "https://ratlogin.example.com/authorize";
              token_url = "https://ratlogin.example.com/token";
              api_url = "https://ratlogin.example.com/userinfo";
              scopes = "openid profile email groups";
              login_attribute_path = "preferred_username";
              name_attribute_path = "name";
              email_attribute_path = "email";
              # configure your admin DIDs here:
              role_attribute_path = "contains(groups[*], 'did:plc:yourdid') && 'Admin' || 'Viewer'";
              use_pkce = true;
              allow_sign_up = true;
            };
          }
        ];
      };
    };
}

To register applications at runtime instead, run the following and copy the key generated:

sudo -u ratlogin ratlogin add-client \
  --id gitea \
  --redirect-uri https://gitea.example.com/user/oauth2/ratlogin/callback \
  --allow did:plc:yourdid

Install (Other) #

See examples/compose/.

Development #

Make use of the dev shell and justfile:

direnv allow
just lint
just test
just build
just check

License #

BSD-3-Clause.

See also apenwarr/atlogin, anirudh.fi/atlogin, and kira.ws/atlogin.

Banner art adapted from horizontal spinning rat by kittatro.