k8scd/immich/httpd.conf-cm.yml

apiVersion: v1
kind: ConfigMap
metadata:
  name: httpd-conf
data:
  httpd.conf: |
    ServerRoot "/usr/local/apache2"
    Listen 8002
    LoadModule mpm_event_module modules/mod_mpm_event.so
    LoadModule authn_core_module modules/mod_authn_core.so
    LoadModule authz_core_module modules/mod_authz_core.so
    LoadModule xml2enc_module modules/mod_xml2enc.so
    LoadModule proxy_html_module modules/mod_proxy_html.so
    LoadModule log_config_module modules/mod_log_config.so
    LoadModule headers_module modules/mod_headers.so
    LoadModule proxy_module modules/mod_proxy.so
    LoadModule proxy_http_module modules/mod_proxy_http.so
    LoadModule http2_module modules/mod_http2.so
    LoadModule proxy_http2_module modules/mod_proxy_http2.so
    LoadModule unixd_module modules/mod_unixd.so
    LoadModule authopenid_module /usr/lib/apache2/modules/mod_auth_openid.so
    LoadModule dir_module modules/mod_dir.so
    LoadModule alias_module modules/mod_alias.so
    LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
    LoadModule rewrite_module modules/mod_rewrite.so

    MaxConnectionsPerChild 30

    <IfModule unixd_module>
    User www-data
    Group www-data
    </IfModule>

    ServerAdmin webmaster@scoutingmbg.nl
    ServerName foto.scoutingmbg.nl

    <Directory />
        AllowOverride none
        Require all denied
    </Directory>

    DocumentRoot "/usr/local/apache2/htdocs"

    <Directory "/usr/local/apache2/htdocs">
        Options Indexes FollowSymLinks
        AllowOverride None
    </Directory>

    <Location />
      AuthType			  OpenID
      require valid-user
      
      AuthOpenIDDBLocation              /tmp/mod_auth_openid.db
      AuthOpenIDTrusted                 ^https://login.scouting.nl/.*$ ^https://login.scouting.nl/user/$
      AuthOpenIDUseCookie               On
      AuthOpenIDCookieName              open_id_session_id
      AuthOpenIDCookieLifespan          31536000
      AuthOpenIDServerName              https://foto.scoutingmbg.nl
      AuthOpenIDSingleIdP               https://login.scouting.nl/user/
      AuthOpenIDSecureCookie            On    
    </Location>

    <Location "/manifest.json">
      AuthType None
      Require all granted
    </Location>

    <Location "/static/build">
      AuthType None
      Require all granted
    </Location>

    <Location "/build">
      AuthType None
      Require all granted
    </Location>

    <Location "/api/v1/ws">
      AuthType None
      Require all granted
    </Location>

    <Location "/static">
      AuthType None
      Require all granted
    </Location>

    AllowEncodedSlashes NoDecode
    ProxyPreserveHost Off

    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://mbg-photoprism-svc:2342/$1" [P,L]

    ProxyPass /api wss://helm-immich-server:2283/api/
    ProxyPassReverse /api wss://helm-immich-server:2283/api/
    ProxyPass / http://helm-immich-server:2283/
    ProxyPassReverse / http://helm-immich-server:2283/
    ProxyRequests off

    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Max-Age "1000"
    Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

    <IfModule dir_module>
        DirectoryIndex index.html
    </IfModule>

    <Files ".ht*">
        Require all denied
    </Files>

    ErrorLog /proc/self/fd/2
    LogLevel warn

    <IfModule log_config_module>
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        LogFormat "%h %l %u %t \"%r\" %>s %b" common
        <IfModule logio_module>
          LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
        </IfModule>
        CustomLog /proc/self/fd/1 common
    </IfModule>

    <IfModule alias_module>
        ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
    </IfModule>
    <Directory "/usr/local/apache2/cgi-bin">
        AllowOverride None
        Options None
        Require all granted
    </Directory>
    <IfModule headers_module>
        RequestHeader unset Proxy early
    </IfModule>
    <IfModule mime_module>
        TypesConfig conf/mime.types
        AddType application/x-compress .Z
        AddType application/x-gzip .gz .tgz
    </IfModule>
    <IfModule proxy_html_module>
        Include conf/extra/proxy-html.conf
    </IfModule>
    <IfModule ssl_module>
        SSLRandomSeed startup builtin
        SSLRandomSeed connect builtin
    </IfModule>