immich: log in with Scouts Online only

foto.scoutingmbg.nl now goes straight to immich instead of through
sol-auth. immich starts the Scouts Online login right away, the password
login is off and the login page no longer shows the password of the
shared viewing account. share-sync is on, so everyone gets every album
and the group's library in their timeline.

sol-auth stays deployed for now, so switching the route back is the way
back.

immich/httproute.yaml

@@ -9,10 +9,12 @@ spec:
     sectionName: https-foto
   hostnames:
   - foto.scoutingmbg.nl
+  # Straight to immich, which logs people in with Scouts Online through
+  # authentik (docs/immich-scouts-online.md).
   rules:
   - backendRefs:
-    - name: sol-auth-svc
+    - name: helm-immich-server
-      port: 8002
+      port: 2283
     # No limit on the whole request, as with nginx. Envoy's default of 15s
     # cuts off uploads and long-lived connections.
     timeouts:

immich/immich-config.yaml

@@ -20,7 +20,6 @@ spec:
         immich-config.yaml: |
           server:
             externalDomain: https://foto.scoutingmbg.nl
-            loginPageMessage: "Hallo, login met email: foto@scoutingmbg.nl, wachtwoord: mbg"
           storageTemplate:
             enabled: true
             template: "{{`{{y}}/{{#if album}}{{album}}{{else}}Other/{{MM}}{{/if}}/{{filename}}`}}"
@@ -34,9 +33,12 @@ spec:
             scope: openid email profile immich
             buttonText: Inloggen met Scouts Online
             autoRegister: true
-            autoLaunch: false
+            # /auth/login?autoLaunch=0 still shows the login page
+            autoLaunch: true
+          # Admins log in through authentik too. To get back in without it,
+          # enable this again (immich-admin can't change a config file).
           passwordLogin:
-            enabled: true
+            enabled: false
   data:
     - secretKey: client_secret
       remoteRef:

immich/share-sync.yaml

@@ -143,8 +143,6 @@ metadata:
   name: share-sync
   namespace: immich
 spec:
-  # Off until immich logs in through Scouts Online
-  suspend: true
   schedule: "*/10 * * * *"
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 1