noah/dotfiles
1
0
Fork 0
mirror of https://github.com/nmasur/dotfiles synced 2026-09-08 13:36:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(immich): configure oidc authentication

Browse Source
This commit is contained in:
Noah Masur
2026-09-07 15:03:27 +00:00
parent d3914768c8
commit 7f8400ff58
4 changed files with 56 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CHANGELOG.md
+7
View File
@@ -2,6 +2,13 @@
## 2026-09-06
- **Configured OpenID Connect (OIDC) authentication for Immich**:
- Configured `services.immich.settings.oauth` with OIDC settings pointing to Pocket ID (`auth.masu.rs`), using client ID `1f4e0f8d-6cee-4d67-8d53-74bf6c18ae09`.
- Added secret management for `immich-oidc-secret.age` via `secrets.immich-oidc-secret` with owner `immich` and group `shared` (0440).
- Wired client secret substitution using NixOS's native `clientSecret._secret = config.secrets.immich-oidc-secret.dest`, leveraging `utils.genJqSecretsReplacement` with systemd `LoadCredential`.
- Configured `systemd.services.immich-server` to order after `immich-oidc-secret-secret.service`.
- Updated `docs/oidc-services.md` with the verified configuration and redirect URIs.
- **Fixed OpenSSH authorized principals certificate authentication for Cloudflare Tunnel**:
- Replaced manual `environment.etc."ssh/authorized_principals/${username}"` symlink and `Match User` config with NixOS native `users.users.<name>.openssh.authorizedPrincipals`.
- Root cause: `environment.etc` without an explicit `mode` creates symlinks pointing into `/nix/store`, which has group-writable mode `0775` (`nixbld` group). Under `StrictModes yes`, sshd refused authentication with `bad ownership or modes for directory /nix/store`, causing certificate principal matching to fail with `Certificate does not contain an authorized principal`.
docs/oidc-services.md
+4 -4
View File
@@ -91,13 +91,13 @@ All client secrets should be encrypted with `agenix` under the respective servic
- **Pocket ID Redirect URIs:**
- Web: `https://photos.masu.rs/auth/login`
- Mobile: `app.immich:///oauth-callback`
- **NixOS Configuration (`immich.nix`):**
- **Setup in `immich/immich.nix`:**
```nix
services.immich.settings.oauth = {
enabled = true;
issuerUrl = "https://auth.masu.rs";
clientId = "immich";
clientSecret = "..."; # or IMMICH_OAUTH_CLIENT_SECRET via environment file
issuerUrl = "https://${hostnames.auth}";
clientId = "1f4e0f8d-6cee-4d67-8d53-74bf6c18ae09";
clientSecret._secret = config.secrets.immich-oidc-secret.dest;
scope = "openid profile email";
autoRegister = true;
buttonText = "Login with Pocket ID";