Using Codeberg, Gitea, or Forgejo as OIDC provider for Tailscale

Requirements

An account on Codeberg, Gitea instance, or Forgejo instance.

A domain name. E.g., I use moonshadow.dev.

The primary email address on your Codeberg, Gitea, or Forgejo account must be from the above domain name. E.g., mine is hyperreal@moonshadow.dev .

A publicly accessible web server to host your webfinger file. You could also use Codeberg Pages for this with your custom domain. The web server must serve content at your domain. E.g., https://moonshadow.dev .

Webfinger

In the web root of your web server, create the .well-known/webfinger file. For example, on mine, I have the following:

{
"subject": "acct:hyperreal@moonshadow.dev",
"links": [
{
"rel": "http://openid.net/specs/connect/1.0/issuer",
"href": "https://codeberg.org"
}
]
}

You can use the Webfinger lookup tool to make sure it is setup correctly.

The value of the "subject" field must contain the email address at the domain you own. The value of the "href" field must be the URL of the Codeberg, Gitea instance, or Forgejo instance.

Create an OAuth2 application on Codeberg, Gitea, or Forgejo

On Codeberg, Gitea, or Forgejo, go to your User Settings -> Applications -> Manage OAuth2 applications.

Application name: tailscale

Redirect URI: https://login.tailscale.com/a/oauth_response

Confidential client: checked

Click on Create. Now copy and save the Client ID and Client secret that was generated.

Sign up with Tailscale

Resources