mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
abed11dbaa
foto.scoutingmbg.nl now goes straight to immich instead of through sol-auth. immich starts the Scouts Online login right away, the password login is off and the login page no longer shows the password of the shared viewing account. share-sync is on, so everyone gets every album and the group's library in their timeline. sol-auth stays deployed for now, so switching the route back is the way back.
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
# immich's settings, rendered with the OAuth client secret from Vault. With
|
|
# a config file the settings are read-only in the admin UI. `{{`...`}}` keeps
|
|
# immich's own template syntax away from ESO's.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-config
|
|
namespace: immich
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: immich-config
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
immich-config.yaml: |
|
|
server:
|
|
externalDomain: https://foto.scoutingmbg.nl
|
|
storageTemplate:
|
|
enabled: true
|
|
template: "{{`{{y}}/{{#if album}}{{album}}{{else}}Other/{{MM}}{{/if}}/{{filename}}`}}"
|
|
# authentik passes on the Scouts Online login and sets the
|
|
# immich_role and immich_quota claims (authentik/blueprint-scouting.yaml).
|
|
oauth:
|
|
enabled: true
|
|
issuerUrl: https://authentik.rubenhensen.nl/application/o/immich/
|
|
clientId: immich
|
|
clientSecret: "{{ .client_secret }}"
|
|
scope: openid email profile immich
|
|
buttonText: Inloggen met Scouts Online
|
|
autoRegister: true
|
|
# /auth/login?autoLaunch=0 still shows the login page
|
|
autoLaunch: true
|
|
# Admins log in through authentik too. To get back in without it,
|
|
# enable this again (immich-admin can't change a config file).
|
|
passwordLogin:
|
|
enabled: false
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/immich-oidc
|
|
property: client_secret
|