Fix immich setup

modules/server/containers/apps/immich.nix

@@ -63,10 +63,37 @@ in {
         until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
           sleep 5
         done
-        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/admin/users" \
+        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/auth/admin-sign-up" \
+          -H "Content-Type: application/json" -H "Accept: application/json" \
+          -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'" }'
+
+
+        IMMICH_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$IMMICH_URL/api/auth/login" \
         -H "Content-Type: application/json" \
-        -H "Accept: application/json" \
-        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'" }'
+        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'"}' \
+        | ${pkgs.jq}/bin/jq -r '.accessToken')        
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.oauth.enabled = true | 
+                          .oauth.autoRegister = true |
+                          .oauth.autoLaunch = true |
+                          .oauth.signingAlgorithm = "RS256" |
+                          .oauth.profileSigningAlgorithm = "RS256" |
+                          .oauth.clientId = "'"$IMMICH_OAUTH_ID"'" | 
+                          .oauth.clientSecret = "'"$IMMICH_OAUTH_SECRET"'" | 
+                          .oauth.issuerUrl = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}" | 
+                          .oauth.scope = "openid profile email" |
+                          .oauth.buttonText = "Login with SSO"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        ''}
+
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.storageTemplate.enable = true |
+                          .storageTemplate.template = "{{y}}/{{#if album}}{{album}}{{else}}{{MM}}{{/if}}/{{filename}}"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        ''}
+        
     '';
   };
 }

modules/server/containers/apps/jellyfin.nix

@@ -115,6 +115,7 @@ in {
         echo "Jellyfin initialization successfully completed!"
       fi
 
+      ${lib.optionalString (serverCfg.containers ? authentik) ''
       JELLYFIN_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Users/AuthenticateByName" \
         -H "Content-Type: application/json" \
         -H "Authorization: MediaBrowser Client=\"Bash Script\", Device=\"Server Terminal\", DeviceId=\"script-12345\", Version=\"1.0.0\"" \
@@ -166,6 +167,7 @@ in {
         echo "ERROR: LDAP Plugin Setup Failed."
         exit 1
       fi
+      ''}
 
       echo "Completed Setup"