Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| services:immich [2025/02/24 08:18] – willy | services:immich [2025/03/13 14:41] (current) – [Installation] willy | ||
|---|---|---|---|
| Line 18: | Line 18: | ||
| Immich needs to be installed using a docker compose file. This is the official and only supported installation method. I will show you, of course, how to run it rootless with podman. Immich installation is detailed [[https:// | Immich needs to be installed using a docker compose file. This is the official and only supported installation method. I will show you, of course, how to run it rootless with podman. Immich installation is detailed [[https:// | ||
| - | I assume you have already created the photo user and group (see [[services: | + | I assume you have already created the photo user and group (see [[selfhost: |
| <code bash> | <code bash> | ||
| useradd -d / | useradd -d / | ||
| Line 114: | Line 114: | ||
| ==== SSO authentication setup ==== | ==== SSO authentication setup ==== | ||
| - | WIP | + | Immich support direct integration with [[selfhost: |
| + | |||
| + | First of all, you need to configure Authelia with a new client: | ||
| + | < | ||
| + | identity_providers: | ||
| + | oidc: | ||
| + | ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. | ||
| + | ## See: https:// | ||
| + | clients: | ||
| + | - client_id: << see below to generate ClientID >> | ||
| + | client_name: | ||
| + | client_secret: | ||
| + | public: false | ||
| + | authorization_policy: | ||
| + | redirect_uris: | ||
| + | - ' | ||
| + | - ' | ||
| + | - ' | ||
| + | scopes: | ||
| + | - ' | ||
| + | - ' | ||
| + | - ' | ||
| + | userinfo_signed_response_alg: | ||
| + | </ | ||
| + | |||
| + | To generate a ClientID: | ||
| + | <code bash> | ||
| + | authelia crypto rand --length 72 --charset rfc3986 | ||
| + | </ | ||
| + | This information will need to copied to both authelia config and immich settings. | ||
| + | |||
| + | To generate a Client Secret: | ||
| + | <code bash> | ||
| + | authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 | ||
| + | </ | ||
| + | Please note **both** the hash and the password itself! You will need the password itself in the next step. | ||
| + | |||
| + | Then you need to configure Immich to use Authelia SSO, so go to //Immich web gui → administration → settings → Authentication settings// and enter the following information: | ||
| + | * Issuer URL: https:// | ||
| + | * Client ID: << the generated ClientID >>. | ||
| + | * Client Secret: insecure_secret. | ||
| + | * Scope: openid profile email. | ||
| + | * Button Text: Login with Authelia. | ||
| + | * Auto Register: Enable if desired. | ||
| + | |||