Add sol-auth to immich

immich/helm-immich.yaml

@@ -115,11 +115,18 @@ spec:
                   - host: immich.hensen.io
                     paths:
                       - path: "/"
+                  - host: foto.scoutingmbg.nl
+                    paths:
+                      - path: "/"
+                    service:
+                      name: sol-auth-svc
+                      port:
+                        name: http-svc
                 tls:
                   - secretName:  letsencrypt-prod
                     hosts:
                       - immich.hensen.io
-
+                      - foto.scoutingmbg.nl
 
           machine-learning:
             enabled: true

immich/httpd.conf-cm.yml

@@ -0,0 +1,146 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: httpd-conf
+data:
+  httpd.conf: |
+    ServerRoot "/usr/local/apache2"
+    Listen 8002
+    LoadModule mpm_event_module modules/mod_mpm_event.so
+    LoadModule authn_core_module modules/mod_authn_core.so
+    LoadModule authz_core_module modules/mod_authz_core.so
+    LoadModule xml2enc_module modules/mod_xml2enc.so
+    LoadModule proxy_html_module modules/mod_proxy_html.so
+    LoadModule log_config_module modules/mod_log_config.so
+    LoadModule headers_module modules/mod_headers.so
+    LoadModule proxy_module modules/mod_proxy.so
+    LoadModule proxy_http_module modules/mod_proxy_http.so
+    LoadModule http2_module modules/mod_http2.so
+    LoadModule proxy_http2_module modules/mod_proxy_http2.so
+    LoadModule unixd_module modules/mod_unixd.so
+    LoadModule authopenid_module /usr/lib/apache2/modules/mod_auth_openid.so
+    LoadModule dir_module modules/mod_dir.so
+    LoadModule alias_module modules/mod_alias.so
+    LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
+    LoadModule rewrite_module modules/mod_rewrite.so
+
+    MaxConnectionsPerChild 30
+
+    <IfModule unixd_module>
+    User www-data
+    Group www-data
+    </IfModule>
+
+    ServerAdmin webmaster@scoutingmbg.nl
+    ServerName foto.scoutingmbg.nl
+
+    <Directory />
+        AllowOverride none
+        Require all denied
+    </Directory>
+
+    DocumentRoot "/usr/local/apache2/htdocs"
+
+    <Directory "/usr/local/apache2/htdocs">
+        Options Indexes FollowSymLinks
+        AllowOverride None
+    </Directory>
+
+    <Location />
+      AuthType			  OpenID
+      require valid-user
+      
+      AuthOpenIDDBLocation              /tmp/mod_auth_openid.db
+      AuthOpenIDTrusted                 ^https://login.scouting.nl/.*$ ^https://login.scouting.nl/user/$
+      AuthOpenIDUseCookie               On
+      AuthOpenIDCookieName              open_id_session_id
+      AuthOpenIDCookieLifespan          31536000
+      AuthOpenIDServerName              https://foto.scoutingmbg.nl
+      AuthOpenIDSingleIdP               https://login.scouting.nl/user/
+      AuthOpenIDSecureCookie            On    
+    </Location>
+
+    <Location "/manifest.json">
+      AuthType None
+      Require all granted
+    </Location>
+
+    <Location "/static/build">
+      AuthType None
+      Require all granted
+    </Location>
+
+    <Location "/build">
+      AuthType None
+      Require all granted
+    </Location>
+
+    <Location "/api/v1/ws">
+      AuthType None
+      Require all granted
+    </Location>
+
+    <Location "/static">
+      AuthType None
+      Require all granted
+    </Location>
+
+    AllowEncodedSlashes NoDecode
+    ProxyPreserveHost Off
+
+    RewriteEngine on
+    RewriteCond %{HTTP:Upgrade} websocket [NC]
+    RewriteCond %{HTTP:Connection} upgrade [NC]
+    RewriteRule ^/?(.*) "ws://mbg-photoprism-svc:2342/$1" [P,L]
+
+    ProxyPass / http://helm-immich-server:2283/
+    ProxyPassReverse / http://helm-immich-server:2283/
+    ProxyRequests off
+
+    Header always set Access-Control-Allow-Origin "*"
+    Header always set Access-Control-Max-Age "1000"
+    Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
+
+    <IfModule dir_module>
+        DirectoryIndex index.html
+    </IfModule>
+
+    <Files ".ht*">
+        Require all denied
+    </Files>
+
+    ErrorLog /proc/self/fd/2
+    LogLevel warn
+
+    <IfModule log_config_module>
+        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+        LogFormat "%h %l %u %t \"%r\" %>s %b" common
+        <IfModule logio_module>
+          LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+        </IfModule>
+        CustomLog /proc/self/fd/1 common
+    </IfModule>
+
+    <IfModule alias_module>
+        ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
+    </IfModule>
+    <Directory "/usr/local/apache2/cgi-bin">
+        AllowOverride None
+        Options None
+        Require all granted
+    </Directory>
+    <IfModule headers_module>
+        RequestHeader unset Proxy early
+    </IfModule>
+    <IfModule mime_module>
+        TypesConfig conf/mime.types
+        AddType application/x-compress .Z
+        AddType application/x-gzip .gz .tgz
+    </IfModule>
+    <IfModule proxy_html_module>
+        Include conf/extra/proxy-html.conf
+    </IfModule>
+    <IfModule ssl_module>
+        SSLRandomSeed startup builtin
+        SSLRandomSeed connect builtin
+    </IfModule>

immich/sol-auth-deployment.yml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sol-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sol-auth
+  template:
+    metadata:
+      labels:
+        app: sol-auth
+    spec:
+      # securityContext:
+      #     runAsUser: 1000
+      #     runAsGroup: 1000
+      #     fsGroup: 1000
+      containers:
+        - image: hebury/sol-auth:2.2
+          name: sol-auth
+          resources: 
+            requests:
+              memory: "50Mi"
+            limits:
+              memory: "500Mi"
+          ports:
+            - name: http
+              containerPort: 8002
+              hostPort: 8002
+              protocol: TCP
+          volumeMounts:
+          - name: config-volume
+            mountPath: /config/
+      volumes:
+        - name: config-volume
+          configMap:
+            name: httpd-conf
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 5

immich/sol-auth-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sol-auth-svc
+spec:
+  ports:
+    - name: http-svc
+      port: 8002
+      targetPort: 8002
+  selector:
+    app: sol-auth
+status:
+  loadBalancer: {}