From abed11dbaa2a071e2a2a90affe9f7bf837705b96 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sat, 24 Oct 2026 14:01:23 +0200
Subject: [PATCH] immich: log in with Scouts Online only

foto.scoutingmbg.nl now goes straight to immich instead of through
sol-auth. immich starts the Scouts Online login right away, the password
login is off and the login page no longer shows the password of the
shared viewing account. share-sync is on, so everyone gets every album
and the group's library in their timeline.

sol-auth stays deployed for now, so switching the route back is the way
back.
---
 immich/httproute.yaml     | 6 ++++--
 immich/immich-config.yaml | 8 +++++---
 immich/share-sync.yaml    | 2 --
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/immich/httproute.yaml b/immich/httproute.yaml
index f222c74..ad04376 100644
--- a/immich/httproute.yaml
+++ b/immich/httproute.yaml
@@ -9,10 +9,12 @@ spec:
     sectionName: https-foto
   hostnames:
   - foto.scoutingmbg.nl
+  # Straight to immich, which logs people in with Scouts Online through
+  # authentik (docs/immich-scouts-online.md).
   rules:
   - backendRefs:
-    - name: sol-auth-svc
-      port: 8002
+    - name: helm-immich-server
+      port: 2283
     # No limit on the whole request, as with nginx. Envoy's default of 15s
     # cuts off uploads and long-lived connections.
     timeouts:
diff --git a/immich/immich-config.yaml b/immich/immich-config.yaml
index bbe4f10..d9bac43 100644
--- a/immich/immich-config.yaml
+++ b/immich/immich-config.yaml
@@ -20,7 +20,6 @@ spec:
         immich-config.yaml: |
           server:
             externalDomain: https://foto.scoutingmbg.nl
-            loginPageMessage: "Hallo, login met email: foto@scoutingmbg.nl, wachtwoord: mbg"
           storageTemplate:
             enabled: true
             template: "{{`{{y}}/{{#if album}}{{album}}{{else}}Other/{{MM}}{{/if}}/{{filename}}`}}"
@@ -34,9 +33,12 @@ spec:
             scope: openid email profile immich
             buttonText: Inloggen met Scouts Online
             autoRegister: true
-            autoLaunch: false
+            # /auth/login?autoLaunch=0 still shows the login page
+            autoLaunch: true
+          # Admins log in through authentik too. To get back in without it,
+          # enable this again (immich-admin can't change a config file).
           passwordLogin:
-            enabled: true
+            enabled: false
   data:
     - secretKey: client_secret
       remoteRef:
diff --git a/immich/share-sync.yaml b/immich/share-sync.yaml
index 848053a..7720def 100644
--- a/immich/share-sync.yaml
+++ b/immich/share-sync.yaml
@@ -143,8 +143,6 @@ metadata:
   name: share-sync
   namespace: immich
 spec:
-  # Off until immich logs in through Scouts Online
-  suspend: true
   schedule: "*/10 * * * *"
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 1