feat(immich): configure oidc authentication

platforms/nixos/modules/nmasur/presets/services/immich/immich-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBOUXFn
+MmFqRWIxOUltQ3lPd1czZ3prbElXaURRV01rSUJGczhka0FOZkNrCkVFaXp2cnd0
+eTFhQUVlY001WnhRUVowSEdORS9MQWdTajhiUWtBVnpaZjAKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIHg2ZGVSVDRSRVBUenBSTWhVbTFTRzFESXRyTEl6OEdoUDJmV2FZ
+T0tPMXMKZ281MmhJd1EyV3VsNTVlNHYxcWE5cGdmTW5mVkNiM1J5ejNWQlBVQ3hM
+UQotPiBzc2gtZWQyNTUxOSBuanZYNUEgUDhObFRyMCsxWkhGK1lKU25WenllZmRj
+NnB5RHJyQjlscGE4NW1uVEJuQQpUQTFXNklzdEcrZjlOSUM3ZzV5OGlvREdJRjlu
+MERGUkdjcXR6REtNUU1ZCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBob2ZLQnNYVFpx
+aVBEb2ZVOWVpUGZtU3FTUmNoS214cUxGeVZhM1NFZkNZCk5IV2VDMnc3L2Y4OEEx
+b1ZSVys0dHpDUlo5UFA2akNKSHFNTi9JTUlnNEEKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IDZBd3k2ZE85Nm53MGdhNnJkUWFWVXEzTFRWU1lMSWp2L1FaYkdZRy9zQ2cK
+TENkNFhsUi9VY2xPSFMwVmRNeXBxS1dFR1VtRDZsQ0xRSTdJQkJxODhiSQotLS0g
+bnpxUGRtVVYvc1R5VUk5VDE4Mmx0WEVNMDZNc0tSSktCTzJlcjJmL3Y0bwqr2hdI
+U3VNIk0qy4sWUdRCPqdyGK+F4qmcbD5MrPBQYNrc2aQ/zr5E/OkZn7k6vCvGMC9k
+zrjpVlAxLB2cRsBmVw==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/immich/immich.nix

@@ -10,6 +10,18 @@ in
   options.nmasur.presets.services.immich.enable = lib.mkEnableOption "Immich photo manager";
   config = lib.mkIf cfg.enable {
 
+    secrets.immich-oidc-secret = {
+      source = ./immich-oidc-secret.age;
+      dest = "${config.secretsDirectory}/immich-oidc-secret";
+      owner = config.services.immich.user;
+      group = config.services.immich.group;
+      permissions = "0440";
+    };
+    systemd.services.immich-oidc-secret-secret = {
+      requiredBy = [ "immich-server.service" ];
+      before = [ "immich-server.service" ];
+    };
+
     services.immich = {
       enable = true;
       port = 2283;
@@ -19,7 +31,18 @@ in
       machine-learning.environment = { };
       mediaLocation = "/data/images";
       secretsFile = null;
-      settings.server.externalDomain = "https://${hostnames.photos}";
+      settings = {
+        server.externalDomain = "https://${hostnames.photos}";
+        oauth = {
+          enabled = true;
+          issuerUrl = "https://${hostnames.auth}";
+          clientId = "1f4e0f8d-6cee-4d67-8d53-74bf6c18ae09";
+          clientSecret._secret = config.secrets.immich-oidc-secret.dest;
+          scope = "openid profile email";
+          autoRegister = true;
+          buttonText = "Login with Pocket ID";
+        };
+      };
       environment = {
         IMMICH_ENV = "production";
         IMMICH_LOG_LEVEL = "log";
@@ -28,6 +51,10 @@ in
       };
     };
 
+    systemd.services.immich-server = {
+      after = [ "immich-oidc-secret-secret.service" ];
+    };
+
     nmasur.presets.services.caddy.routes = [
       {
         match = [ { host = [ hostnames.photos ]; } ];