brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(immich): document OIDC-only login, external library setup, and firewall rule

Browse source 
- Adds OIDC disable-password-login workflow to README (enforce SSO after
  confirming Zitadel PKCE works; clarifies client secret is not needed)
- Expands external library section with user UUID lookup and warning about
  Immich blocking paths under the upload volume
- Adds Allow Caddy to Immich rule (10.0.15.5 → 10.0.10.15:2283) to
  firewall-rules.md
This commit is contained in:
Brian Pooe 2026-06-27 12:18:12 +02:00
parent 2fa6de1d4c
commit 11935bd02a
2 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
docker-compose-files/immich/README.md
View file

@ -26,18 +26,26 @@ Self-hosted photo and video management solution with high performance and visual
Optional OIDC settings can also be supplied. Set `OIDC_ENABLED=true`
explicitly when enabling OAuth; leaving it unset keeps Immich local-login
only.
only. Zitadel with PKCE does not require a client secret — leave
`OIDC_CLIENT_SECRET` empty.
```dotenv
OIDC_ENABLED=true
OIDC_ISSUER=https://auth.example.com/application/o/immich/
OIDC_ISSUER=https://zitadel.example.com/
OIDC_CLIENT_ID=<immich-client-id>
OIDC_CLIENT_SECRET=<immich-client-secret-or-empty-for-pkce>
OIDC_NAME=Single Sign-On
OIDC_CLIENT_SECRET=
OIDC_NAME=<button-label>
OIDC_AUTO_REDIRECT=false
OIDC_MOBILE_OVERRIDE_ENABLED=false
OIDC_DISABLE_LOCAL_AUTH=false
```
Once OIDC is confirmed working, set `OIDC_DISABLE_LOCAL_AUTH=true` and
restart the server to enforce SSO-only login:
```bash
sed -i 's/DISABLE_PASSWORD_LOGIN=false/DISABLE_PASSWORD_LOGIN=true/' /opt/immich/docker-compose.yml
docker compose -f /opt/immich/docker-compose.yml up -d --no-deps --force-recreate immich-server
```
2. **Create Directories**:
Create the local appdata directories and the shared media directory:
```bash
@ -87,7 +95,13 @@ curl -s -X POST http://<immich-ip>:2283/api/libraries/$LIB_ID/scan \
-H "Authorization: Bearer $TOKEN"
```
The import path `/mnt/external/<user-uuid>` corresponds to `$IMMICH_EXTERNAL_LIBRARY/<user-uuid>` on the host. Immich blocks any path under `/data/upload/` for external libraries, which is why a separate mount is required.
The `<user-uuid>` is the Immich user's UUID — find it at **Settings → Account** in the Immich UI, or via:
```bash
curl -s http://<immich-ip>:2283/api/users/me -H "Authorization: Bearer $TOKEN" | python3 -c 'import sys,json; print(json.load(sys.stdin)["id"])'
```
> [!IMPORTANT]
> Immich rejects any external library import path that falls under `/data/upload/` (the upload volume). The separate `/mnt/external` mount exists specifically to work around this restriction — the same photos are accessible at both paths inside the container, but only `/mnt/external` is accepted for external libraries.
## Privileged Mode Rationale

1
docs/network/firewall-rules.md
View file

@ -21,6 +21,7 @@ This document serves as the single source of truth for the manual custom firewal
| `Allow CADDY to UNAS` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.25` | `443` | **Yes** | Allows Caddy to proxy the UNAS Pro dashboard. |
| `Allow CADDY to Synology` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.24` | `5000,5001` | **Yes** | Allows Caddy to proxy the Synology NAS DSM dashboard (HTTP/HTTPS). |
| `Allow Caddy to Arr Stack` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.20` | `5055,6767,7878,8000,8080,8096,8191,8282,8989,9696` | **Yes** | Allows Caddy to reach Arr-stack apps (Bazarr, Radarr, Gluetun, QBittorrent, Emby, Flaresolverr, Sabnzbd, Sonarr, Prowlarr, Seerr). |
| `Allow Caddy to Immich` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.15` | `2283` | **Yes** | Allows Caddy to proxy Immich (photo management) on LXC 102. |
| `Allow Caddy to HA` | Allow | Both | TCP | `CADDY` | Any | `IoT` | `10.0.30.6` | `8080, 8123` | **Yes** | Allows Caddy to proxy Home Assistant and Zigbee2MQTT. |
| `Allow Caddy to PBS` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.8` | `8007` | **Yes** | Allows Caddy to proxy Proxmox Backup Server. |
| `Allow Caddy to Proxmox` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.10` | `8006` | **Yes** | Allows Caddy to proxy Proxmox VE. |