Fix immich setup

modules/server/containers/apps/immich.nix

@@ -63,10 +63,37 @@ in {
         until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
           sleep 5
         done
-        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/admin/users" \
+        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/auth/admin-sign-up" \
+          -H "Content-Type: application/json" -H "Accept: application/json" \
+          -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'" }'
+
+
+        IMMICH_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$IMMICH_URL/api/auth/login" \
         -H "Content-Type: application/json" \
-        -H "Accept: application/json" \
-        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'" }'
+        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'"}' \
+        | ${pkgs.jq}/bin/jq -r '.accessToken')        
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.oauth.enabled = true | 
+                          .oauth.autoRegister = true |
+                          .oauth.autoLaunch = true |
+                          .oauth.signingAlgorithm = "RS256" |
+                          .oauth.profileSigningAlgorithm = "RS256" |
+                          .oauth.clientId = "'"$IMMICH_OAUTH_ID"'" | 
+                          .oauth.clientSecret = "'"$IMMICH_OAUTH_SECRET"'" | 
+                          .oauth.issuerUrl = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}" | 
+                          .oauth.scope = "openid profile email" |
+                          .oauth.buttonText = "Login with SSO"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        ''}
+
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.storageTemplate.enable = true |
+                          .storageTemplate.template = "{{y}}/{{#if album}}{{album}}{{else}}{{MM}}{{/if}}/{{filename}}"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        ''}
+        
     '';
   };
 }

modules/server/containers/apps/jellyfin.nix

@@ -115,6 +115,7 @@ in {
         echo "Jellyfin initialization successfully completed!"
       fi
 
+      ${lib.optionalString (serverCfg.containers ? authentik) ''
       JELLYFIN_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Users/AuthenticateByName" \
         -H "Content-Type: application/json" \
         -H "Authorization: MediaBrowser Client=\"Bash Script\", Device=\"Server Terminal\", DeviceId=\"script-12345\", Version=\"1.0.0\"" \
@@ -166,6 +167,7 @@ in {
         echo "ERROR: LDAP Plugin Setup Failed."
         exit 1
       fi
+      ''}
 
       echo "Completed Setup"
 

modules/server/sops/server.yaml

@@ -1,4 +1,4 @@
-CUSTOM: ENC[AES256_GCM,data:TXsMI69UrctXA8jnv/qHVm8ljt6APlVZ0iLe7v3gZsojxlu4BG78vXxbR+oZVcOkp3qvI5e1M1EVNwcyL+M1wIkwIaIaXVtdjzJrSBOj9RQ6hos32DW5JYe1lRcXrW4T2ZjP4Ll3oDhMBnpcRweLcqjf9RrrQ3T3PQlH6uh1+wiQo0jhEoUc+k47uhnIi47vPCj2EUIpxeUFNu30pg2vBVDkkvtWdwa8kTySmmnzLQ5zWcsOcQWWWyEgkxPz1bGENSBiTl9Qlhf+gdISWA==,iv:ysPEvNvaxw8P0dYlLoBe7qZIdh5qmIusbuPK4a0lMxE=,tag:4X/eq6gX4h15JfKn+sEHdA==,type:str]
+CUSTOM: ENC[AES256_GCM,data:zdcXDQmPriSoddWmqly1jEZ+dZ3rRyUrfdJMuyn8gJ3I7l9SJE6viiPIVkyTIIl4pqgogjY+RuauGpSK2kH0rtW2WCZSIXnqJj4sQQG39GoODxTUIa4xged7hCyhSnqwkJrfdBsOdjuGAt9cTUPh2vGr9ELrFgmPPFDhNuLOt5I6tcUkdh8YtZBFxi2h2TmGNaf11GRaVuH8q3jbNURDZTSR2SmCmNMt0jDnN6WScVOqhFR0ffSTHhyLFSgz6ChSKyzGOu6DAJuNmSNLWfdUz05tX6GeWvvArxcxUBVKVViWLxFSIsOunVUf+PlA36nbAJL1k0DDYvIerSNkN+4OXSuMKGgYsbMo5AEUACN2yrPoSNsAAknvpoFZ5XvmWk0ADUdbeg2YlyMrYcNWuhjQqZXekZi8ATH564At8OIalDCugGcC+Gw4BUyFdQtoiVuIL9Pmc63z3qoAxdYwF48b9QPsR/n9/Gh3YIb5yOKnfxBtltlgnQwDO6BHOWzpSDBMB/FzcS1dNCYMbUa5hsQ7Fw0SHA==,iv:sLnuiBpqIBhwByfJrc6haD7WnL65UcLJCR6fXTDHIgE=,tag:MDBV+1BBrsDz3spiR/C3Tw==,type:str]
 TRAEFIK: ENC[AES256_GCM,data:Ei+/OL7xwNaOEg3rSaz95N78nvp51lC63XCplNzeD+bBMGcK9G7HoyQxfpaJ7S0MkuMW0ZXT2nJ4GES40GoJCZIrnEiSBm2tpjDfNjlS/rFwxx0wVfM1nsEuBf3pL5dqiCNa9+Lad2Cd,iv:d1MH0ive+E8xuUK0CIOXZeEigHJKVGlFaq0iH4KSbZA=,tag:VTARuNeotr2I0+fdOk+iqA==,type:str]
 AUTHENTIK: ENC[AES256_GCM,data:HlUFb7JjzSMTM345miSLlUE4SEXgaRAx7SkDDQzaJzs9VuifJKtOE2M4PCKc35VjVt9xIFH+YoIE93re10Rwbe+QEaUphPOgb/G7jRhaaPV/roBYuv6uO5xy68jaVJZpobxajOSVUmJa1JANCh1qrX0+Imr6udYULvK6wQzAnu2tEDkElQ3eZtezUa4E5ia1j7RCYTTPW9oie+YEVJl5Aws2HzPK5q0wKojZOmHanbnKzij3KnSgtsMc3ftL1Fam3wlSk2n3Tw0nz8aBag9IPwYje5zdBkDJY6qiBwYKcBPQUIW+Na0xX2JHymwJSzMdKmW8cEV9b1fXCPsnYVXulb4VMVkTk4MibZ3YT57wlFhqhSy7D39ZTySllIZg8sOrj8cKhpJ3HlSbceD1GnPJatVzZkDkDeyICLu9sYX3B+KrCDlL5sUMPagUFc3g3HUAPxLVPltoP69ro69acUoz5w8gkAwHlE45I3biC/jLz4telEcW8GkF868j3gsHiayE3f87T5MOPvuvhAFdSMl3SF1ND3mWjJq7+FmA6BhxgESg4m+vPnYyVumcbXJnbgfW69BgPYcL1CWZcA+SP6OWg9GOYT5SuWixkaGn2TgRAUj3nlCcAja8,iv:uXAyOIBl9lGYBvALMdvp2hf6cj6QGWRcyUvEsjIDr1I=,tag:iLxO/qYT2zafXhFGVVUYkA==,type:str]
 NEXTCLOUD: ENC[AES256_GCM,data:IWitzubILQ5SrGdO3UQZboisqAECt5lXOqHVg4yAKxedG7ZLOgVp6jPV+4VVDC13KEkxIsiYjjNvjqnOXCdYWQIC13YZ+o2IBDI9PgavBB3nmjfi0Q7BVki6C8qCtbM5H9uFlQ3h7rkPyEbE3pHa3dY5uwgdtmvw3qKf2UAZGIJCU7dKamjuTCucGitOEG434jFQik9duHZs7EV3AZrkLXqOfdvftvdpciDb/4/K7h/4uEYSXJ94Lf0b16/NRUcR,iv:1UvcbqC3hJEHU9t6Z+N226DTJEcgM315ynYkxPKpYSM=,tag:FGkXlUw+7LRu1/cpMys7OA==,type:str]
@@ -30,8 +30,8 @@ sops:
             S1NaTVFTL0FCdm1EQmRsUnlhclZNZlEKEgIe60qkvY8+UocjQU+WM2dTL/1y3Kqk
             d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-14T22:43:50Z"
-    mac: ENC[AES256_GCM,data:K040mOkh3ZAW4WiTdbMqk1gtGGadirpzunPxfoRlAfglcJb4DTyaCwpPr2TFlYebYkI8ijNi2BG6w7vHQngtvPGkd15ETfG6waTk9XaAc4nVQZKa3xmmV6eEcT2OKOznP7aJfaJXE5oh30QsDrAMJkYIwKd+jWnzSrSvUKG2XzE=,iv:1q/naMcw/eUVmukTL9gIl0eIyHWkwMm4TY6pZAfixcQ=,tag:EK44ywbAAPM3lPui9q5L9A==,type:str]
+    lastmodified: "2026-05-15T00:11:31Z"
+    mac: ENC[AES256_GCM,data:CijimdAqB/4m7jH05l7YVYmFHjEkT2dsAe8yyFh3GRjkfpIr73KDiNYwigYMVtHOT63J0IU45cUUWRBgg2PHnWV3RQsHHsFLmWvsyLC/PyMSXF/DOm1aQMi8Dy473TyLi8L+UNelE4SIj4yqjC4lmwHLXNrF3iwtTktrCaGW42k=,iv:xNdJHyDPw/gGC0P0r+sUKYVXgmV1ObMZXQapABGaL40=,tag:F7eu1NwEqCEqi78/5MvCKw==,type:str]
     pgp:
         - created_at: "2026-05-05T23:46:27Z"
           enc: |-