Immich: added openid login

secrets/default.nix

@@ -37,5 +37,9 @@ in {
       file = ./forgejo-mailpass.age;
       owner = abstrServiceUser "forgejo";
     };
+    immich-oidc = mkIf server {
+      file = ./immich-oidc.age;
+      owner = abstrServiceUser "immich";
+    };
   };
 }

secrets/immich-oidc.age

@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 GQzYWA MbczMCSPu7pJru1rmOsFuloCYLKlh7koC5drXcKlwiw
+ZghUrcs7YT3ciwqOkrPDEzlZe3qN9ypBw3xRGYWNPaY
+-> ssh-ed25519 MfR7VA KB6RE2QZ//Z6xoyQC502dJeg79rYXFJJdOwV+c6tOWo
+e1zIz2nsV9JbBaadTnONrPLI5Ztyv9vf4Ewzd9uSHnU
+-> ssh-ed25519 +cvRTg GntHLoUwpIrxm3FcVw+Bavaq6kLaZpVdTRLoMMVfpAY
+abE1ZkhS39vylBg8bZ5K3vgnXr70Vbk1bLCKsCFlUvU
+-> ssh-ed25519 WCPLrA +/GlB5CbM/1FwI5JE63DJVUChADjJfD3jJY3Y2KmXEU
+pPqBhV49/wg/hWffFm2XFRGC9p1nQ57tj1YK7pPkQ3U
+-> ssh-ed25519 7/ziYw lxlJVNMIqfoMPj6VGTt2V4PxFi+6WRMfOYcv1hpEMkM
+kd8CI7RECJA5uPJu33D61OEnqWwZuNQ6VmYLqXew6gc
+-> ssh-ed25519 VQy60Q YSgYVPPN7QutKhbv6/1vmoRnh14KXs0g2k9qxKuvQ2U
+FL3fImxWoBeHrCLd+jp/a1oRd/Acgi6sV/g40dCRrTA
+--- TipdjwDPkRxiV/R1FUYCm/tcD6M+XEaZhQjrzwMxiuA
+証E%ｷZDｹ<44>Ts<54>,ﾘ5ﾉ
ｳ<>LﾀO<EFBE80>ﾔ
ｿzｴｧｱﾖ<>ｸT､<>Θ<0B>ｬ煖_蕘熙H演始ﾛﾅ*ﾔxQ7$釉淸v`Wﾈ<04>瀲t%<25>6<0C>5

secrets/secrets.nix

@@ -21,4 +21,5 @@ in {
   "mail-admin.age".publicKeys = keys;
   "zitadel-key.age".publicKeys = keys;
   "forgejo-mailpass.age".publicKeys = keys;
+  "immich-oidc.age".publicKeys = keys;
 }

system/server/forgejo.nix

@@ -46,7 +46,7 @@ in {
             ENABLED = true;
             SUBJECT_PREFIX = "JSWGit";
             PROTOCOL = "smtps";
-            SMTP_ADDR = "mail.jsw.tf";
+            SMTP_ADDR = "mail.jsw.tf"; #FIXME: replace with config... to stalwart setting once using stalwart nixos module.
             SMTP_PORT = 465;
             FROM = "git@jsw.tf";
             USER = "git";

system/server/immich.nix

@@ -1,18 +1,45 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }: let
+  inherit (lib) mkIf mkForce mkDefault;
+
   cfg = config.niksos.server;
+  oidcSubstitute = "*@#OPENIDCLIENTSECRET#@*";
+  config-dir = "/run/immich-conf";
 in {
-  services.immich = {
+  config =
-    enable = cfg;
+    mkIf cfg
+    {
+      users.users.${config.services.immich.user}.extraGroups = ["video" "render"];
+      services.caddy.virtualHosts."photos.jsw.tf".extraConfig = ''
+        reverse_proxy localhost:9002
+      '';
+
+      services.immich = mkIf cfg {
+        enable = true;
 
         port = 9002;
         machine-learning.enable = false;
 
+        accelerationDevices = mkDefault null;
+
+        #NOTE: immich doesn't support variables in their config file, so we have to subsitute ourselfs..
+        environment.IMMICH_CONFIG_FILE = mkForce "${config-dir}/immich.json";
         settings = {
           server.externalDomain = "https://photos.jsw.tf";
+          oauth = {
+            enabled = true;
+            autoLaunch = true;
+            autoRegister = true;
+            buttonText = "Login with JSWAuth";
+            clientId = "329735769805619570";
+            clientSecret = oidcSubstitute;
+            issuerUrl = "https://${config.services.zitadel.settings.ExternalDomain}/.well-known/openid-configuration";
+          };
+          passwordLogin.enabled = false;
           ffmpeg = {
             crf = 23;
             threads = 0;
@@ -48,14 +75,24 @@ in {
             accelDecode = true;
           };
         };
-
-    accelerationDevices = lib.mkDefault null;
       };
-  users.users.immich = lib.mkIf cfg {extraGroups = ["video" "render"];}; #NOTE: was first groups = lib.mkIf.. but then users.immich gets set even when server is disabled.
 
-  services.caddy.virtualHosts."photos.jsw.tf" = {
+      systemd = {
-    extraConfig = ''
+        services.immich-server = {
-      reverse_proxy localhost:9002
+          preStart = let
+            refConfig = (pkgs.formats.json {}).generate "immich.json" config.services.immich.settings;
+            newConfig = "${config-dir}/immich.json";
+            replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
+          in ''
+            umask 077
+            cp -f '${refConfig}' '${newConfig}'
+            chmod u+w '${newConfig}'
+            ${replaceSecretBin} '${oidcSubstitute}' '${config.age.secrets.immich-oidc.path}' '${newConfig}'
           '';
         };
+        tmpfiles.rules = [
+          "d ${config-dir} 0700 immich immich"
+        ];
+      };
+    };
 }