From c3505bc8e3002a6c82340f7fb218fb12b78eb0f9 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Sat, 24 Oct 2026 14:14:43 +0200 Subject: [PATCH] immich: remove sol-auth foto.scoutingmbg.nl goes straight to immich since the switch to Scouts Online, so the Apache with mod_auth_openid (OpenID 2) in front of it has no traffic left. --- gateway/retry-policy.yaml | 6 +- immich/httpd.conf-cm.yml | 132 --------------------------------- immich/sol-auth-deployment.yml | 40 ---------- immich/sol-auth-service.yaml | 13 ---- immich/sol-auth/Dockerfile | 13 ---- 5 files changed, 3 insertions(+), 201 deletions(-) delete mode 100644 immich/httpd.conf-cm.yml delete mode 100644 immich/sol-auth-deployment.yml delete mode 100644 immich/sol-auth-service.yaml delete mode 100644 immich/sol-auth/Dockerfile diff --git a/gateway/retry-policy.yaml b/gateway/retry-policy.yaml index 0552e32..4d2bb90 100644 --- a/gateway/retry-policy.yaml +++ b/gateway/retry-policy.yaml @@ -1,8 +1,8 @@ # Retry a request when the backend drops a kept-alive connection just as # Envoy sends a request over it. Envoy answers that with a 503 (flag UC) and -# does not retry by default; ingress-nginx did. It happens most behind the -# Apache of sol-auth (immich), which recycles its processes after 30 -# connections, and broke immich's page loads. +# does not retry by default; ingress-nginx did. It broke immich's page loads +# behind the Apache of sol-auth (since removed), which recycled its +# processes after 30 connections, and shows up less often elsewhere. apiVersion: gateway.envoyproxy.io/v1alpha1 kind: BackendTrafficPolicy metadata: diff --git a/immich/httpd.conf-cm.yml b/immich/httpd.conf-cm.yml deleted file mode 100644 index 5952210..0000000 --- a/immich/httpd.conf-cm.yml +++ /dev/null @@ -1,132 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: httpd-conf -data: - httpd.conf: | - ServerRoot "/usr/local/apache2" - Listen 8002 - LoadModule mpm_event_module modules/mod_mpm_event.so - LoadModule authn_core_module modules/mod_authn_core.so - LoadModule authz_core_module modules/mod_authz_core.so - LoadModule xml2enc_module modules/mod_xml2enc.so - LoadModule proxy_html_module modules/mod_proxy_html.so - LoadModule log_config_module modules/mod_log_config.so - LoadModule headers_module modules/mod_headers.so - LoadModule proxy_module modules/mod_proxy.so - LoadModule proxy_http_module modules/mod_proxy_http.so - LoadModule http2_module modules/mod_http2.so - LoadModule proxy_http2_module modules/mod_proxy_http2.so - LoadModule unixd_module modules/mod_unixd.so - LoadModule authopenid_module /usr/lib/apache2/modules/mod_auth_openid.so - LoadModule dir_module modules/mod_dir.so - LoadModule alias_module modules/mod_alias.so - LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so - LoadModule rewrite_module modules/mod_rewrite.so - - MaxConnectionsPerChild 30 - - - User www-data - Group www-data - - - ServerAdmin webmaster@scoutingmbg.nl - ServerName foto.scoutingmbg.nl - - - AllowOverride none - Require all denied - - - DocumentRoot "/usr/local/apache2/htdocs" - - - Options Indexes FollowSymLinks - AllowOverride None - - - - AuthType OpenID - require valid-user - - AuthOpenIDDBLocation /tmp/mod_auth_openid.db - AuthOpenIDTrusted ^https://login.scouting.nl/.*$ ^https://login.scouting.nl/user/$ - AuthOpenIDUseCookie On - AuthOpenIDCookieName open_id_session_id - AuthOpenIDCookieLifespan 31536000 - AuthOpenIDServerName https://foto.scoutingmbg.nl - AuthOpenIDSingleIdP https://login.scouting.nl/user/ - AuthOpenIDSecureCookie On - - - - AuthType None - Require all granted - - - AllowEncodedSlashes NoDecode - ProxyPreserveHost Off - - RewriteEngine on - RewriteRule ^/?photos/?$ /sharing [R=301,L] - - ProxyPass / http://helm-immich-server:2283/ - ProxyPassReverse / http://helm-immich-server:2283/ - RewriteEngine on - RewriteCond %{HTTP:Upgrade} websocket [NC] - RewriteCond %{HTTP:Connection} upgrade [NC] - RewriteRule ^/?(.*) "ws://helm-immich-server:2283/$1" [P,L] - - - # must be bigger than pingInterval (25s by default) + pingTimeout (20s by default) - ProxyTimeout 60 - ProxyRequests off - - Header always set Access-Control-Allow-Origin "*" - Header always set Access-Control-Max-Age "1000" - Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token" - - - DirectoryIndex index.html - - - - Require all denied - - - ErrorLog /proc/self/fd/2 - LogLevel warn - - - LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined - LogFormat "%h %l %u %t \"%r\" %>s %b" common - - LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio - - CustomLog /proc/self/fd/1 common - - - - ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/" - - - AllowOverride None - Options None - Require all granted - - - RequestHeader unset Proxy early - - - TypesConfig conf/mime.types - AddType application/x-compress .Z - AddType application/x-gzip .gz .tgz - - - Include conf/extra/proxy-html.conf - - - SSLRandomSeed startup builtin - SSLRandomSeed connect builtin - diff --git a/immich/sol-auth-deployment.yml b/immich/sol-auth-deployment.yml deleted file mode 100644 index be9d264..0000000 --- a/immich/sol-auth-deployment.yml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: sol-auth -spec: - replicas: 1 - selector: - matchLabels: - app: sol-auth - template: - metadata: - labels: - app: sol-auth - spec: - # securityContext: - # runAsUser: 1000 - # runAsGroup: 1000 - # fsGroup: 1000 - containers: - - image: hebury/sol-auth:2.3 - name: sol-auth - resources: - requests: - memory: "50Mi" - limits: - memory: "500Mi" - ports: - - name: http - containerPort: 8002 - hostPort: 8002 - protocol: TCP - volumeMounts: - - name: config-volume - mountPath: /config/ - volumes: - - name: config-volume - configMap: - name: httpd-conf - restartPolicy: Always - terminationGracePeriodSeconds: 5 \ No newline at end of file diff --git a/immich/sol-auth-service.yaml b/immich/sol-auth-service.yaml deleted file mode 100644 index 938d4d1..0000000 --- a/immich/sol-auth-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: sol-auth-svc -spec: - ports: - - name: http-svc - port: 8002 - targetPort: 8002 - selector: - app: sol-auth -status: - loadBalancer: {} diff --git a/immich/sol-auth/Dockerfile b/immich/sol-auth/Dockerfile deleted file mode 100644 index 2e94e9d..0000000 --- a/immich/sol-auth/Dockerfile +++ /dev/null @@ -1,13 +0,0 @@ -FROM httpd:2.4-bullseye -RUN apt-get update && \ - apt-get install --no-install-recommends -y \ - ca-certificates libapache2-mod-auth-openid -RUN touch /tmp/mod_auth_openid.db && chown www-data /tmp/mod_auth_openid.db -RUN mkdir /config -RUN touch /config/httpd.conf -RUN rm /usr/local/apache2/conf/httpd.conf -RUN ln -s /config/httpd.conf /usr/local/apache2/conf/httpd.conf - -# how to build: docker build . -t hebury/sol-auth:2.3 -# how to push: docker push hebury/sol-auth:2.3 -# do not remember how to build for arm atm. \ No newline at end of file