Merge pull request #6075 from okxlin/maint-pr-6001-pocket-id

Maintain pocket-id app package for 2.14.0
2026-09-25 00:01:02 +00:00 · 2026-08-21 11:56:25 +08:00
parent fc5cb0512c 8580236323
commit e755404818
17 changed files with 99 additions and 282 deletions
@@ -1,68 +0,0 @@
-additionalProperties:
-  formFields:
-    - default: 1411
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: HTTP Port
-      labelZh: HTTP 端口
-      label:
-        en: HTTP Port
-        zh: HTTP 端口
-        zh-Hant: HTTP 埠
-        ja: HTTP ポート
-        ko: HTTP 포트
-        ru: HTTP-порт
-        ms: Port HTTP
-        pt-br: Porta HTTP
-      required: true
-      rule: paramPort
-      type: number
-    - default: http://localhost:1411
-      edit: true
-      envKey: POCKET_ID_APP_URL
-      labelEn: External App URL
-      labelZh: 外部访问地址
-      label:
-        en: External App URL
-        zh: 外部访问地址
-        zh-Hant: 外部存取網址
-        ja: 外部アプリ URL
-        ko: 외부 앱 URL
-        ru: Внешний URL приложения
-        ms: URL aplikasi luaran
-        pt-br: URL externo do aplicativo
-      required: true
-      rule: paramExtUrl
-      type: text
-    - default: generate
-      edit: true
-      envKey: POCKET_ID_ENCRYPTION_KEY
-      labelEn: Encryption Key
-      labelZh: 加密密钥
-      label:
-        en: Encryption Key
-        zh: 加密密钥
-        zh-Hant: 加密金鑰
-        ja: 暗号化キー
-        ko: 암호화 키
-        ru: Ключ шифрования
-        ms: Kunci penyulitan
-        pt-br: Chave de criptografia
-      required: true
-      type: password
-    - default: "false"
-      edit: true
-      envKey: POCKET_ID_TRUST_PROXY
-      labelEn: Trusted Proxy Addresses
-      labelZh: 可信代理地址
-      label:
-        en: Trusted Proxy Addresses
-        zh: 可信代理地址
-        zh-Hant: 可信代理位址
-        ja: 信頼するプロキシアドレス
-        ko: 신뢰할 프록시 주소
-        ru: Адреса доверенных прокси
-        ms: Alamat proksi dipercayai
-        pt-br: Enderecos de proxy confiaveis
-      required: true
-      type: text
@@ -1,27 +0,0 @@
-services:
-  pocket-id:
-    image: pocketid/pocket-id:v2.12.0-distroless
-    container_name: ${CONTAINER_NAME}
-    restart: always
-    networks:
-      - 1panel-network
-    ports:
-      - "${PANEL_APP_PORT_HTTP}:1411"
-    environment:
-      - APP_URL=${POCKET_ID_APP_URL}
-      - ENCRYPTION_KEY=${POCKET_ID_ENCRYPTION_KEY}
-      - TRUST_PROXY=${POCKET_ID_TRUST_PROXY}
-    volumes:
-      - "./data:/app/data"
-    healthcheck:
-      test: ["CMD", "/app/pocket-id", "healthcheck"]
-      interval: 90s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    labels:
-      createdBy: "Apps"
-
-networks:
-  1panel-network:
-    external: true
@@ -1,5 +1,5 @@
+CONTAINER_NAME=pocket-id-compose-check
 PANEL_APP_PORT_HTTP=1411
 POCKET_ID_APP_URL=http://localhost:1411
 POCKET_ID_ENCRYPTION_KEY=generate
 POCKET_ID_TRUST_PROXY=false
-CONTAINER_NAME=pocket-id
@@ -0,0 +1,84 @@
+additionalProperties:
+  formFields:
+  - default: 1411
+    edit: true
+    envKey: PANEL_APP_PORT_HTTP
+    labelEn: HTTP Port
+    labelZh: HTTP 端口
+    label:
+      en: HTTP Port
+      zh: HTTP 端口
+      zh-Hant: HTTP 埠
+      ja: HTTP ポート
+      ko: HTTP 포트
+      ru: HTTP-порт
+      ms: Port HTTP
+      pt-br: Porta HTTP
+    required: true
+    rule: paramPort
+    type: number
+  - default: http://localhost:1411
+    edit: true
+    envKey: POCKET_ID_APP_URL
+    labelEn: External App URL
+    labelZh: 外部访问地址
+    label:
+      en: External App URL
+      zh: 外部访问地址
+      zh-Hant: 外部存取網址
+      ja: 外部アプリ URL
+      ko: 외부 앱 URL
+      ru: Внешний URL приложения
+      ms: URL aplikasi luaran
+      pt-br: URL externo do aplicativo
+    required: true
+    rule: paramExtUrl
+    type: text
+  - default: generate
+    edit: true
+    envKey: POCKET_ID_ENCRYPTION_KEY
+    labelEn: Encryption Key
+    labelZh: 加密密钥
+    label:
+      en: Encryption Key
+      zh: 加密密钥
+      zh-Hant: 加密金鑰
+      ja: 暗号化キー
+      ko: 암호화 키
+      ru: Ключ шифрования
+      ms: Kunci penyulitan
+      pt-br: Chave de criptografia
+    required: true
+    type: password
+  - default: 'false'
+    edit: true
+    envKey: POCKET_ID_TRUST_PROXY
+    labelEn: Trusted Proxy Addresses
+    labelZh: 可信代理地址
+    label:
+      en: Trusted Proxy Addresses
+      zh: 可信代理地址
+      zh-Hant: 可信代理位址
+      ja: 信頼するプロキシアドレス
+      ko: 신뢰할 프록시 주소
+      ru: Адреса доверенных прокси
+      ms: Alamat proksi dipercayai
+      pt-br: Enderecos de proxy confiaveis
+    required: true
+    type: text
+  - default: Asia/Shanghai
+    edit: true
+    envKey: TZ
+    labelEn: Timezone
+    labelZh: 时区
+    label:
+      en: Timezone
+      zh: 时区
+      zh-Hant: 時區
+      ja: タイムゾーン
+      ko: 시간대
+      ru: Часовой пояс
+      ms: Zon waktu
+      pt-br: Fuso horário
+    required: true
+    type: text
@@ -1,6 +1,6 @@
 services:
  pocket-id:
-    image: pocketid/pocket-id:latest-distroless
+    image: "pocketid/pocket-id:v2.14.0-distroless"
    container_name: ${CONTAINER_NAME}
    restart: always
    networks:
@@ -1,15 +1,24 @@
 name: Pocket ID
 tags:
-  - Security
+- Security
 title: 以通行密钥为核心的 OIDC 身份提供商
 description: 以通行密钥为核心的 OIDC 身份提供商
 additionalProperties:
  key: pocket-id
  name: Pocket ID
  tags:
-    - Security
+  - Security
+  type: website
+  website: https://pocket-id.org/
+  document: https://pocket-id.org/docs/
+  github: https://github.com/pocket-id/pocket-id
  shortDescZh: 以通行密钥为核心的 OIDC 身份提供商
  shortDescEn: A passkey-first OIDC identity provider
+  crossVersionUpdate: true
+  limit: 1
+  architectures:
+  - amd64
+  - arm64
  description:
    en: A passkey-first OIDC identity provider for self-hosted services
    zh: 面向自托管服务、以通行密钥为核心的 OIDC 身份提供商
@@ -18,13 +27,5 @@ additionalProperties:
    ko: 자체 호스팅 서비스를 위한 패스키 우선 OIDC ID 공급자
    ru: OIDC-провайдер для самостоятельного размещения с приоритетом ключей доступа
    ms: Penyedia identiti OIDC berasaskan kunci laluan untuk perkhidmatan hos kendiri
-    pt-br: Provedor de identidade OIDC com foco em chaves de acesso para servicos auto-hospedados
-  type: website
-  crossVersionUpdate: true
-  limit: 1
-  website: https://pocket-id.org/
-  github: https://github.com/pocket-id/pocket-id
-  document: https://pocket-id.org/docs/
-  architectures:
-    - amd64
-    - arm64
+    pt-br: Provedor de identidade OIDC com foco em chaves de acesso para servicos
+      auto-hospedados
@@ -1,5 +0,0 @@
-PANEL_APP_PORT_HTTP=1411
-POCKET_ID_APP_URL=http://localhost:1411
-POCKET_ID_ENCRYPTION_KEY=generate
-POCKET_ID_TRUST_PROXY=false
-CONTAINER_NAME=pocket-id
@@ -1,68 +0,0 @@
-additionalProperties:
-  formFields:
-    - default: 1411
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: HTTP Port
-      labelZh: HTTP 端口
-      label:
-        en: HTTP Port
-        zh: HTTP 端口
-        zh-Hant: HTTP 埠
-        ja: HTTP ポート
-        ko: HTTP 포트
-        ru: HTTP-порт
-        ms: Port HTTP
-        pt-br: Porta HTTP
-      required: true
-      rule: paramPort
-      type: number
-    - default: http://localhost:1411
-      edit: true
-      envKey: POCKET_ID_APP_URL
-      labelEn: External App URL
-      labelZh: 外部访问地址
-      label:
-        en: External App URL
-        zh: 外部访问地址
-        zh-Hant: 外部存取網址
-        ja: 外部アプリ URL
-        ko: 외부 앱 URL
-        ru: Внешний URL приложения
-        ms: URL aplikasi luaran
-        pt-br: URL externo do aplicativo
-      required: true
-      rule: paramExtUrl
-      type: text
-    - default: generate
-      edit: true
-      envKey: POCKET_ID_ENCRYPTION_KEY
-      labelEn: Encryption Key
-      labelZh: 加密密钥
-      label:
-        en: Encryption Key
-        zh: 加密密钥
-        zh-Hant: 加密金鑰
-        ja: 暗号化キー
-        ko: 암호화 키
-        ru: Ключ шифрования
-        ms: Kunci penyulitan
-        pt-br: Chave de criptografia
-      required: true
-      type: password
-    - default: "false"
-      edit: true
-      envKey: POCKET_ID_TRUST_PROXY
-      labelEn: Trusted Proxy Addresses
-      labelZh: 可信代理地址
-      label:
-        en: Trusted Proxy Addresses
-        zh: 可信代理地址
-        zh-Hant: 可信代理位址
-        ja: 信頼するプロキシアドレス
-        ko: 신뢰할 프록시 주소
-        ru: Адреса доверенных прокси
-        ms: Alamat proksi dipercayai
-        pt-br: Enderecos de proxy confiaveis
-      required: true
-      type: text
@@ -1 +0,0 @@
-
@@ -1,92 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
-ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
-
-fail() {
-  printf '%s\n' "$1" >&2
-  exit 1
-}
-
-read_env_value() {
-  local key="$1"
-  local value=""
-  value="$(grep -E "^${key}=" "$ENV_FILE" | tail -n 1 | cut -d '=' -f 2- || true)"
-  if [[ ${#value} -ge 2 && "${value:0:1}" == '"' && "${value: -1}" == '"' ]]; then
-    value="${value:1:${#value}-2}"
-  elif [[ ${#value} -ge 2 && "${value:0:1}" == "'" && "${value: -1}" == "'" ]]; then
-    value="${value:1:${#value}-2}"
-  fi
-  printf '%s\n' "$value"
-}
-
-set_env_value() {
-  local key="$1"
-  local value="$2"
-  local temp_file
-  temp_file="$(mktemp "${ROOT_DIR}/.pocket-id-env.tmp.XXXXXX")"
-  awk -v key="$key" -v value="$value" '
-    BEGIN { written = 0 }
-    $0 ~ "^" key "=" {
-      if (!written) {
-        print key "=" value
-        written = 1
-      }
-      next
-    }
-    { print }
-    END {
-      if (!written) print key "=" value
-    }
-  ' "$ENV_FILE" > "$temp_file"
-  chmod 600 "$temp_file"
-  mv -f -- "$temp_file" "$ENV_FILE"
-}
-
-generate_key() {
-  local value=""
-  if command -v openssl >/dev/null 2>&1; then
-    value="$(openssl rand -base64 32 | tr -d '\n')"
-  elif [[ -r /dev/urandom ]] && command -v base64 >/dev/null 2>&1; then
-    value="$(head -c 32 /dev/urandom | base64 | tr -d '\n')"
-  fi
-  [[ "$value" =~ ^[A-Za-z0-9+/]{43}=$ ]] || fail "Unable to generate a secure Pocket ID encryption key"
-  printf '%s\n' "$value"
-}
-
-[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found"
-[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link"
-
-app_url="$(read_env_value POCKET_ID_APP_URL)"
-[[ -n "$app_url" ]] || fail "POCKET_ID_APP_URL is required"
-case "$app_url" in
-  *$'\n'* | *$'\r'* | *\\* | *'$'* | *'#'* | *'"'* | *"'") fail "POCKET_ID_APP_URL contains unsupported dotenv characters" ;;
-esac
-
-trust_proxy="$(read_env_value POCKET_ID_TRUST_PROXY)"
-[[ -n "$trust_proxy" ]] || trust_proxy=false
-[[ "$trust_proxy" =~ ^(false|[0-9A-Fa-f:.,/[:space:]-]+)$ ]] || fail "POCKET_ID_TRUST_PROXY must be false or a comma-separated IP/CIDR list"
-
-requested_key="$(read_env_value POCKET_ID_ENCRYPTION_KEY)"
-if [[ -z "$requested_key" || "$requested_key" == "generate" ]]; then
-  encryption_key="$(generate_key)"
-else
-  [[ "$requested_key" =~ ^[A-Za-z0-9+/]{43}=$ ]] || fail "POCKET_ID_ENCRYPTION_KEY must be generate or a base64-encoded 32-byte key"
-  encryption_key="$requested_key"
-fi
-
-data_dir="${ROOT_DIR}/data"
-[[ ! -L "$data_dir" ]] || fail "Pocket ID data directory must not be a symbolic link"
-mkdir -p -- "$data_dir"
-if [[ "$(id -u)" -eq 0 ]]; then
-  chown 65532:65532 "$data_dir"
-  chmod 700 "$data_dir"
-else
-  [[ "$(stat -c '%u:%g' "$data_dir")" == "65532:65532" ]] || fail "Pocket ID init must run as root to prepare the non-root data directory"
-  [[ "$(stat -c '%a' "$data_dir")" == "700" ]] || fail "Pocket ID data directory must have mode 700"
-fi
-
-set_env_value POCKET_ID_APP_URL "$app_url"
-set_env_value POCKET_ID_ENCRYPTION_KEY "$encryption_key"
-set_env_value POCKET_ID_TRUST_PROXY "$trust_proxy"
@@ -1,2 +0,0 @@
-#!/bin/bash
-docker-compose down --volumes
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
-exec "${SCRIPT_DIR}/init.sh"