sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: update flake and make necessary changes, disable immich for now

Browse source
This commit is contained in:
oddlama 2025-09-05 20:48:22 +02:00
parent 20477ecdc5
commit 3c322bbdbf
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
13 changed files with 228 additions and 156 deletions
Download patch file Download diff file Expand all files Collapse all files

44
hosts/ward/guests/kanidm.nix
View file

@ -37,7 +37,7 @@ in
age.secrets.kanidm-oauth2-forgejo = mkRandomSecret;
age.secrets.kanidm-oauth2-grafana = mkRandomSecret;
age.secrets.kanidm-oauth2-immich = mkRandomSecret;
# age.secrets.kanidm-oauth2-immich = mkRandomSecret;
age.secrets.kanidm-oauth2-firezone = mkRandomSecret;
age.secrets.kanidm-oauth2-mealie = mkRandomSecret;
age.secrets.kanidm-oauth2-paperless = mkRandomSecret;
@ -115,27 +115,27 @@ in
inherit (globals.kanidm) persons;
# Immich
groups."immich.access" = { };
systems.oauth2.immich = {
displayName = "Immich";
originUrl = [
"https://${globals.services.immich.domain}/auth/login"
"https://${globals.services.immich.domain}/api/oauth/mobile-redirect"
];
originLanding = "https://${globals.services.immich.domain}/";
basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path;
preferShortUsername = true;
# XXX: PKCE is currently not supported by immich
allowInsecureClientDisablePkce = true;
# XXX: RS256 is used instead of ES256 so additionally we need legacy crypto
enableLegacyCrypto = true;
scopeMaps."immich.access" = [
"openid"
"email"
"profile"
];
};
# # Immich
# groups."immich.access" = { };
# systems.oauth2.immich = {
# displayName = "Immich";
# originUrl = [
# "https://${globals.services.immich.domain}/auth/login"
# "https://${globals.services.immich.domain}/api/oauth/mobile-redirect"
# ];
# originLanding = "https://${globals.services.immich.domain}/";
# basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path;
# preferShortUsername = true;
# # XXX: PKCE is currently not supported by immich
# allowInsecureClientDisablePkce = true;
# # XXX: RS256 is used instead of ES256 so additionally we need legacy crypto
# enableLegacyCrypto = true;
# scopeMaps."immich.access" = [
# "openid"
# "email"
# "profile"
# ];
# };
# Firezone
groups."firezone.access" = { };