sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: reenable immich with native module, prepare nixos-extra-modules update

Browse source
This commit is contained in:
oddlama 2025-09-13 20:18:54 +02:00
parent ef2f2a9b77
commit 157c303f38
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
25 changed files with 1521 additions and 184 deletions
Download patch file Download diff file Expand all files Collapse all files

40
hosts/ward/guests/kanidm.nix
View file

@ -37,7 +37,7 @@ in
age.secrets.kanidm-oauth2-forgejo = mkRandomSecret;
age.secrets.kanidm-oauth2-grafana = mkRandomSecret;
# age.secrets.kanidm-oauth2-immich = mkRandomSecret;
age.secrets.kanidm-oauth2-immich = mkRandomSecret;
age.secrets.kanidm-oauth2-firezone = mkRandomSecret;
age.secrets.kanidm-oauth2-mealie = mkRandomSecret;
age.secrets.kanidm-oauth2-paperless = mkRandomSecret;
@ -115,27 +115,23 @@ in
inherit (globals.kanidm) persons;
# # Immich
# groups."immich.access" = { };
# systems.oauth2.immich = {
# displayName = "Immich";
# originUrl = [
# "https://${globals.services.immich.domain}/auth/login"
# "https://${globals.services.immich.domain}/api/oauth/mobile-redirect"
# ];
# originLanding = "https://${globals.services.immich.domain}/";
# basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path;
# preferShortUsername = true;
# # XXX: PKCE is currently not supported by immich
# allowInsecureClientDisablePkce = true;
# # XXX: RS256 is used instead of ES256 so additionally we need legacy crypto
# enableLegacyCrypto = true;
# scopeMaps."immich.access" = [
# "openid"
# "email"
# "profile"
# ];
# };
# Immich
groups."immich.access" = { };
systems.oauth2.immich = {
displayName = "Immich";
originUrl = [
"https://${globals.services.immich.domain}/auth/login"
"https://${globals.services.immich.domain}/api/oauth/mobile-redirect"
];
originLanding = "https://${globals.services.immich.domain}/";
basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path;
preferShortUsername = true;
scopeMaps."immich.access" = [
"openid"
"email"
"profile"
];
};
# Firezone
groups."firezone.access" = { };