From 39304337fcb4057811c667bb7042a01b6a45792f Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Thu, 11 Jun 2026 22:45:34 -0400
Subject: [PATCH] [marvin] add grimmory oidc

---
 hosts/marvin/services/library.nix                    | 12 +++++++++++-
 .../marvin/services/secrets/grimmory-oidc-secret.age |  8 ++++++++
 hosts/marvin/services/secrets/secrets.nix            |  1 +
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 hosts/marvin/services/secrets/grimmory-oidc-secret.age

diff --git a/hosts/marvin/services/library.nix b/hosts/marvin/services/library.nix
index e1db6f47..ca509161 100644
--- a/hosts/marvin/services/library.nix
+++ b/hosts/marvin/services/library.nix
@@ -6,7 +6,7 @@
   ...
 }:
 let
-  d = self.lib.data.services.booklore;
+  d = self.data.services.grimmory;
   dataDir = "/var/lib/booklore";
 
   bookloreFolder = {
@@ -44,6 +44,16 @@ let
   ];
 in
 {
+  dish.oidcClients = [
+    {
+      clientId = d.oidcId;
+      displayName = "dishNet Library";
+      homepageUrl = "https://${d.extUrl}";
+      clientSecretFile = ./secrets/grimmory-oidc-secret.age;
+      redirectUrls = [ "https://${d.extUrl}/oauth2-callback" ];
+      postLogoutUrl = "https://${d.extUrl}/api/v1/auth/oidc/backchannel-logout";
+    }
+  ];
   systemd = {
     slices.system-grimmory = {
       description = "Grimmory Ebook Manager System Slice";
diff --git a/hosts/marvin/services/secrets/grimmory-oidc-secret.age b/hosts/marvin/services/secrets/grimmory-oidc-secret.age
new file mode 100644
index 00000000..4e499f2d
--- /dev/null
+++ b/hosts/marvin/services/secrets/grimmory-oidc-secret.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> mlkem768x25519 uqfkcjt0ywl1WM1qswmEZx3dYE4fBdzM0g1B6SgMJVwMQG2ENfuz8yTSe8cpzAHB+f1VQUYttIADUaj+YGlyd33hT5+aqadnhRISUFtBOmIU/Wfxelfvhx6p0oG6TPW2Eis4DKPX8yyPBP/8CSrSbFbFSwb36j87axFw0KspshUsFrrWbz0SLd5Vq/Mw1sJ0OD0n4B1qQRyAwwWGdm55knvjT01dNv3LpANr+jQtFSJgHj3XIwwmBWd4JvHp9CdPMoTtf7X2VOHhHCB4yjWDwC1t/OAGDe8fK4Z2oqahvU9kzHRcKHG3qwkuk8N+ny+/kKTAQWIblIICxYpH30I0gLm5MDEVB3F2RhP39UNH+Bly6gGdtUYYotLa2g7EK1VMsgysicKRTQFX5wPWaqwyZdGCSoCfOPBROip0GZ/QJBnlnn/6QNQPS6ilwEnPPXvgV/1TcSUGoK+mQcZzaMaCdcB9BPRVJIqn4YRyU+5r+WbCukRyA4XTAwFS8KrdS0gp66NdkV1IMwIT+lVNM48qTcZg8n4jT5R3gulFNYjI35Y4Vw+elnBcmbwQKprCCRmXjer1r0O3axxdgSRcKcFa6kQuwuTpc0g/r5Lgx/rQ7VPim3GNnu6SZWcZDQj3PCcTx0g4daksFGJHLoT52wmiPU4rexv2QWWAx5ybnpdhpcQwM6qJk/eSt7PYxfXSym/FYCYED4QaznFJvpmTRk8hjXenwfHofcjNPeRsYis4GoCs3nH9Y1NL1niYRmC5EV7Pw/y+Zc4TvRz1LlHihQ2uBXUh4x+h3nrAOlBB6/MdNNzOwuwOuNS/R2QA94L0CAUZ/w44bx+kC2cC0t/wPCYIKuleqfXtbrlTuTTEtdPJ4FnC9U4aUdqkR6gUdcJnl5K/Dtrb/xJv6JDxgTZXlzufPTdw6ljTjnF3G2NLhFbFO0WLuBlnmPwS4D/9yUXplGe7lrnbVX9ZOKH+ngCz/zB6Ozj0StgiuP/D4jQ2A+LCnUzmUyHdeMMfklyfDyNNBq9D37y6ZtCW9YBtXiuS29xnBnJKnJ3WxyqQYrXQTKO0bQDuoE8HKaCSkqSqwcREO2VEhiR0PPhLh+Liyp5orTo+uybCbA/3tpsHjjpd9jeprqB9IQQTFHFZwpsMYUsjKeQVO9SZpJ3IwCbd7lgUPpYqrvhoVfyWzhWREqhrMw++WSKT9YD30r/sIy+nCxZRh42dTpllezsJptSjRNkoY+bzci8NsBNiyRladxsCcMfK8NR98mCb9K3tGLcI0zgpwslRR4tXSGKffy+n90ugr0wy09qHP1f0vSRvHdKdFs+TqNhZC50ihgxQ/JCnyw3fK1cmi1MJMmVPLoyX98fDnXKgarcBC+EOvljaOEh7n2L7DVF1KMX4Xvw38NgyQb0SeNoRWt/ED1fm2Q2G6iLNKrnNRDW7v0MCn60CAix0+/2zA87FAfZ2cUmWQkHHZ1E+iOZ+3SA3zMMjUK7NOey7saoaQg
+6Qw4xUW3bnMvj8iIjEbRsuI/HG7to/UFoklW89dVi/Y
+-> mlkem768x25519 oYYucMGiiOBtdT3udj7LE6+SkxIvxCp4ObF4APtpIOHUgpxnOcCzN/mHmqvq+sIwqba6Z0ShvVT3NRD+QJJKN+MZxCGQjjoo3q/HdyxOmZfceAbbPMfMJXn3GcrC595H4tNLnLE+cCAY7Cn/9l//qZV5muDemaqCZyfYcaODDWXOTY6LXGQ1AjEJLBszYwLupf2Kwi+H7JLTU38OjoCYeVYSL4PoYrYyqKjA9/kCkCSxMvOnv3g2NJe8lff4TPb2oTxHGK+KQXkih2zHg4G6QPFM4HS1Lr9PqzDS5b/p3cXeBYM4439zhbaPzBIDIOTKhAjqjrTd2oVFMgza8aGcn667XaK7tvSRnli3tRVq4N0LKm8b4JFg677pYiJFmO3el+g5QFkwTK1VfGf9zvMGVu5aJlMCvOuc0J1GHxhY/tIhjkiwYofSfqUqqXj/ucN5YRHIy4mll2NdC1MyAbtW1ZsNJEJ2DMTQifqHSvYo2pJOPwsCJ74LKYopJ3cTBI1mXZnkpJqBlnc25fyTBWKA/fxCQ6Ieb2sf+5u9D9+vrxKJAhDVHJqiIhbwngYzbOSOV5sGfZ1KsAlIVUVRxL9SQrzYqM6Mz+gVvRMPyR1IRU9X3zciAkD65uE9F/B3W7MtNs9HslaTOs7MKyIGCWnDQjyFoLTZsVz4xeyXujYNVNLS2bbbwghQujwjT5aRJX7oT1gxYVHRngHIkkd70rxb2LK8qlaFsPtWnnWen14WRNP11ho3Ab3E/seksVjfFiv5fTn1qx4TKCJx7i31qgaZoUiJGvBU4Ytri4vDJxeiV6Q5hwP9/IXoEHX+UnVkN2vEThffLDtCJtav8XjpTMKmoqIDOa/11YrOiXbiT9ByQWxUKbVVU7QHDfj2+d9lWgsKTd6zHvnT4v8K2JGgRggqoe0whwNBJr9xsZsjKHv4paC7Y8ZsfX+sqseNDLtjo/myXGkOgqukI0CiUT2xqFST6e6hRrTabXyhDm9IKTuWYX8cLP2yO+YQifeIo2K1SLnK2uDAtwc4Z/0LTWVly6bcihBHCNIWnZiU3JJqhpnWtkfqfottzZUjcZfJJcsu5x5kOcp6UVctdtsPVDAmzZYraTb5G5xxla/mwFciJ9BVv42FLu95Q9A9jZ+OY42CGPfJ4h5GekW/mrax1+sgMzl+YY7mN0ws8wWblkZ92h2hVvyXfg1RNkA10AQUcao0f77Q+ppdMkTSFCIHpf6QCDbqT+o+HwA2CbvVN6W75K/vnUSR64h/4RBcuKEW1tLlgE2Ial9pmIUBVmhSnzRzExY5vE1S7das7EtqG2aG34oQvKna3wHifPuqhDjwl2yWHH4eKa56gWTCLFPIDksq0PqKCPJr/5FVSwtF6fMMiHK6QDRjoHqypC4S4AYjRE13eONYKe/Yj1Eh8Llmm/6+OthB/yHl0Trmy9GlRmVLTsDUm1Sps2HETdqoIaDQqdeART6mXlcApqXHpbJwICNJ1hDQLw
+ECaoKKPTkuL2bn9ZaMJzgfT66CooZJKNZtG5sPF5iio
+--- uzlSsGS15lB6LQPdxgJawtbyCcgkZDBxu1UUMDk+Hvk
+�Ȫdž��
+����<�}��I��ȝ���NPf���mF�M�/��@�����M/�,�*�'E�2�uH�����A�c^�q�o�#�!�Jb��6��
\ No newline at end of file
diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix
index 3b026d9f..d8c7688a 100644
--- a/hosts/marvin/services/secrets/secrets.nix
+++ b/hosts/marvin/services/secrets/secrets.nix
@@ -27,6 +27,7 @@ in
   "anubis-key.age".publicKeys = marvinDefault;
   "bichon-encryption-password.age".publicKeys = pqKeys;
   "golink-authkey.age".publicKeys = marvinDefault;
+  "grimmory-oidc-secret.age".publicKeys = pqKeys;
   "jellyfin-exporter-secrets.age".publicKeys = pqKeys;
   "miniflux-admin.age".publicKeys = pqKeys;
   "pinchflat-secrets.age".publicKeys = pqKeys;
-- 
2.51.2