From 399387bfb73546343d2beba0b973166bcd13771d Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sat, 24 Oct 2026 13:19:52 +0200
Subject: [PATCH] immich: configure through a config file with OAuth

immich gets its settings from a Secret that ESO renders with the OAuth
client secret from Vault. It keeps the settings that were in the database
(external domain, login page message, storage template) and adds OAuth
through authentik next to the password login, with auto register. With a
config file the settings are read-only in the admin UI.
---
 immich/helm-immich.yaml   | 14 ++++---------
 immich/immich-config.yaml | 44 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 10 deletions(-)
 create mode 100644 immich/immich-config.yaml

diff --git a/immich/helm-immich.yaml b/immich/helm-immich.yaml
index 5c8eba2..026f7f8 100644
--- a/immich/helm-immich.yaml
+++ b/immich/helm-immich.yaml
@@ -50,16 +50,10 @@ spec:
                 # Automatically creating the library volume is not supported by this chart
                 # You have to specify an existing PVC to use
                 existingClaim: immich-claim
-            # configuration is immich-config.json converted to yaml
-            # ref: https://immich.app/docs/install/config-file/
-            #
-            configuration: {}
-              # trash:
-              #   enabled: false
-              #   days: 30
-              # storageTemplate:
-              #   enabled: true
-              #   template: "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}"
+            # The config file is a Secret rendered by ESO, since it holds the
+            # OAuth client secret (immich/immich-config.yaml).
+            configurationKind: Secret
+            existingConfiguration: immich-config
 
           # Dependencies
 
diff --git a/immich/immich-config.yaml b/immich/immich-config.yaml
new file mode 100644
index 0000000..bbe4f10
--- /dev/null
+++ b/immich/immich-config.yaml
@@ -0,0 +1,44 @@
+# immich's settings, rendered with the OAuth client secret from Vault. With
+# a config file the settings are read-only in the admin UI. `{{`...`}}` keeps
+# immich's own template syntax away from ESO's.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-config
+  namespace: immich
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: immich-config
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        immich-config.yaml: |
+          server:
+            externalDomain: https://foto.scoutingmbg.nl
+            loginPageMessage: "Hallo, login met email: foto@scoutingmbg.nl, wachtwoord: mbg"
+          storageTemplate:
+            enabled: true
+            template: "{{`{{y}}/{{#if album}}{{album}}{{else}}Other/{{MM}}{{/if}}/{{filename}}`}}"
+          # authentik passes on the Scouts Online login and sets the
+          # immich_role and immich_quota claims (authentik/blueprint-scouting.yaml).
+          oauth:
+            enabled: true
+            issuerUrl: https://authentik.rubenhensen.nl/application/o/immich/
+            clientId: immich
+            clientSecret: "{{ .client_secret }}"
+            scope: openid email profile immich
+            buttonText: Inloggen met Scouts Online
+            autoRegister: true
+            autoLaunch: false
+          passwordLogin:
+            enabled: true
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: kv/immich-oidc
+        property: client_secret