mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
b2649a682c
The Scouts Online connection now redirects to auth.scoutingmbg.nl, the group's own domain for the authentik login, so immich's OAuth issuer moves there too.
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
# immich's settings, rendered with the OAuth client secret from Vault. With
|
|
# a config file the settings are read-only in the admin UI. `{{`...`}}` keeps
|
|
# immich's own template syntax away from ESO's.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-config
|
|
namespace: immich
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: immich-config
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
immich-config.yaml: |
|
|
server:
|
|
externalDomain: https://foto.scoutingmbg.nl
|
|
storageTemplate:
|
|
enabled: true
|
|
template: "{{`{{y}}/{{#if album}}{{album}}{{else}}Other/{{MM}}{{/if}}/{{filename}}`}}"
|
|
# authentik passes on the Scouts Online login and sets the
|
|
# immich_role and immich_quota claims (authentik/blueprint-scouting.yaml).
|
|
oauth:
|
|
enabled: true
|
|
issuerUrl: https://auth.scoutingmbg.nl/application/o/immich/
|
|
clientId: immich
|
|
clientSecret: "{{ .client_secret }}"
|
|
scope: openid email profile immich
|
|
buttonText: Inloggen met Scouts Online
|
|
autoRegister: true
|
|
# /auth/login?autoLaunch=0 still shows the login page
|
|
autoLaunch: true
|
|
# Admins log in through authentik too. To get back in without it,
|
|
# enable this again (immich-admin can't change a config file).
|
|
passwordLogin:
|
|
enabled: false
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/immich-oidc
|
|
property: client_secret
|