This repository is a Home Assistant custom component that implements a full OpenID Connect (OIDC) Client/Relying Party for authentication. It allows Home Assistant users to log in via an external OIDC Identity Provider (IdP) such as Authentik, Authelia, Keycloak, or any standard OIDC-compliant server. The integration registers a custom auth provider within Home Assistant's auth system, intercepts the default login flow to redirect users to the OIDC provider, and handles the full authorization code flow including PKCE (RFC 7636), ID token validation with configurable signing algorithms, and userinfo retrieval. It supports both public and confidential clients, device code flow for mobile app login, automatic user linking, role-based access mapping from IdP groups, and a multi-step UI configuration wizard for easy setup.
This repository provides a fully automated, one-command deployment of a self-hosted Supabase stack. The setup script (`setup.sh`) orchestrates the entire process: it installs dependencies, clones the repository, generates cryptographic secrets and JWT tokens, configures environment variables, and layers optional docker-compose overrides for Authelia 2FA, Nginx or Caddy reverse proxy, and SSL via Let's Encrypt. The architecture is a Docker Compose multi-service deployment including Supabase Studio, Kong API gateway, GoTrue auth, PostgREST, Realtime, Storage, Edge Functions, and a custom Postgres image. The code is production-grade with robust error handling, CI/CD pipelines (GitHub Actions) that test every configuration matrix (caddy/nginx, basic auth/authelia/redis), and comprehensive integration tests covering CRUD operations, storage, realtime subscriptions, and edge functions. The repository also includes advanced utilities for key management (asymmetric JWTs, opaque API keys) and a sophisticated Postgres 15-to-17 upgrade script (`upgrade-pg17.sh`) that handles binary extraction, pg_upgrade, and post-migration patches. While primarily a deployment tool, the scripts demonstrate high craftsmanship and are safely reusable as templates for similar self-hosting scenarios.