#authentik with Oauth for immich not working without domain.

1 messages · Page 1 of 1 (latest)

thorn leaf
#

...

#

@drifting tree

drifting tree
#

yeah

thorn leaf
#

"now one thing you can do if you dont want to keep using the port is set a dedicated network interface (virtual) to the authentik container so it can have it's own IP and use the normal http/https ports
[17:45]
dont know if this can add value to anyone .. but might be worth moving to support yeah" Do I need to do this for the cert to work?

drifting tree
#

go check what's currently selected ?

#

issue is that you are currently connecting to authentik on that high number port and you pointed it to https.

#

you can also change that port mapping to point to 80 instead so the communication is not using certs

#

for internal only stuff it's not critical

thorn leaf
#

is it possible to insted use authentik http insted of https?

drifting tree
#

change your exposed port configuration in your container configuration (or add)

thorn leaf
drifting tree
#

ok so 10228 is http

#

can you connect to authentik using that one ?

thorn leaf
#

can't connect to authentik at all rn apperantly

drifting tree
#

service is started correctly ?

thorn leaf
drifting tree
#

I've only used truenas a little, do you have a way to see the container log see what's going on ?

thorn leaf
#

all the logs respond with 400

#

so no

drifting tree
#

on unraid authentik has two container (one server and one worker) is it the same with your setup ?

thorn leaf
#

yeah

drifting tree
#

restart the worker ?

thorn leaf
#

can't connect to it apparently

drifting tree
#

well that is not helping 🙂

thorn leaf
#

everything worked before, I did not change anything really

#

should I reinstall authentik?

drifting tree
#

if you do make sure you clear the data associated with the containers

#

btw if I may ask, immich is a photo hosting platform, if you dont plan on advertising it on the internet, why even use authentication to get to it ? you could simply disable auth for it and use

#

The immich-server docker image comes preinstalled with an administrative CLI (immich-admin) that supports the following commands:

Command Description
help Display help
reset-admin-password Reset the password for the admin user
disable-password-login Disable password login
enable-password-login Enable password login
enable-oauth-login Enable OAuth login
disable-oauth-login Disable OAuth login
list-users List Immich users

thorn leaf
#

already have ldap working with jellyfin

#

or is there another setup that is better

drifting tree
#

are your machines joined to a domain of some sort ?

thorn leaf
drifting tree
#

if you can paint a picture of what all your are trying to achieve, that would help

#

what is your "use case" basically 🙂

thorn leaf
#

ok, hold on

drifting tree
#

sure, maybe this whole thing can be resolved with a much simpler approach .. holding on 🙂

thorn leaf
#

idk I can't draw:

image.png
#

or did you mean witout authentik

drifting tree
#

how many users are there ?

thorn leaf
#

5

#

this for family

drifting tree
#

and you restrict all users to different permissions within jelly or immich ?

thorn leaf
#

immich permission should be set to see your photos

drifting tree
#

ok

#

and right now jelly authenticate against authentik via ldap service ?

thorn leaf
#

or

#

well I deleated authentk

#

to reinstall

drifting tree
#

yeah .. but that was the intent at least 🙂

thorn leaf
drifting tree
#

and you have zero need for reverse proxying (or no intention of advertising any of this on the internet) ?

thorn leaf
drifting tree
#

right but with a vpn, it's not advertised .. only the vpn is

thorn leaf
#

oh

#

right

#

sorry

#

😅

drifting tree
#

no worries 🙂

#

so if someone wants to sync the pictures from their phone to immich, they'll need the phone to vpn in first correct ?

thorn leaf
#

I could evade this situation with no domain and use our familes domain, but it already got a working email and stuff and it seems like I need to migrate to cloudflare for it to work to add the way I want, and I dont even have access to the administration.

thorn leaf
#

is that an ok setup?

drifting tree
#

thinking

thorn leaf
#

I need to eat rn, ill be back

drifting tree
#

np

#

few things, do you intent to sync photo from the immich android app, if yes it seems like the app is very finicky about the self signed cert used, might not be needed, but if yes, keep this in mind: ``` # openssl genrsa -des3 -out my-ca.key 2048

openssl req -x509 -new -nodes -key my-ca.key -sha256 -days 1825 -out my-ca.pem```

#

just so it's documented 🙂

thorn leaf
#

hmm ok

drifting tree
#

also, that screenshot shows that you used loadbalancer for the ports

#

any reason ?

thorn leaf
#

That's the default, didn't change it

#

the other option is cluster something

drifting tree
#

hrm ok .. when you recreate the authentik container, you need to assign it a dedicated static IP by using the network bridge (br0) interface

#

this way your truenas existing IP/port mapping will be independant from the authentik one

#

and it'll allow you to use 80/443 on authentik and make things simpler

thorn leaf
drifting tree
#

next you need to pick an internal domain name that you'll use / reuse throughout all the internal services you plan on deploying (abc.internal) (can be whatever)

#

you might already have a br0 interface

#

if you look at truenas network configuration

#

you'll see it there

thorn leaf
#

Hmm okay

drifting tree
#

either the IP is configured on br0 or it's configured directly on the physical interface

thorn leaf
#

is br0 bridged meaning it work as a real device with own ip adress on tje network

drifting tree
#

when truenas (or any other platform supporting containers) creates a bridge, it's like if you had a switch (virtual) inside the computer itself

#

so both truenas and any virtual machine connect to it like it was a real one, which then "bridges" the virtual to the physical network

thorn leaf
#

right so in contrast to virtual NAT?

drifting tree
#

no natting in this

thorn leaf
#

oh

#

ok

drifting tree
#

you shouldn't need any NAT in your internal network

thorn leaf
#

No I meant if bridge is opposite to virtual nat

drifting tree
#

so when you use a virtual nat, it means that the machines (dockers) connected have IP adresses in a dedicated subnet that is not "local lan" accessible, so you need to do a network address translation (NAT) to say that if someone connects to my truenas IP on port 11024 (or whatever) it'll allow the traffic and convert it (internally) to the private IP on the same (or different) port

#

it's a LOT less flexible in what you can do

#

there are some use case where it's useful, but it's far from the easiest approach

#

and for what you are trying to do, your authentik having a real IP in your 10.0.0.0 network is 100 times easier

thorn leaf
#

alrighty alrighty

#

I'll see what I can do

drifting tree
#

now you can go further and use vlans and/or different network ranges to separate your "servers" from the users but that's a different thing

#

ie, I have a network subnet for IoT (esphome automation things), one for my kids wireless SSID, one for my docker servers, one for my physical switch management, etc) but I have a lot (probably too much) of stuff running here 🙂

#

now in truenas, go to network -> interface

#

see if you have a bridge

thorn leaf
#

Alright, just hold on, need to exit my Linux boot.. some issues with /efi not mounting. but I'll solve that another time

drifting tree
#

you can share your screen also if you want

thorn leaf
#

ig, but can take a lot of screenshots

#

I am fast at that

drifting tree
#

ok so no network bridge

#

start with this

#

should take you but a minute

#

not sure if they are the same .. one was for nightly build

#

careful now .. not to isolate your machine from the rest of the world 🙂

grim mason
#

Just a heads up, I would move away from using the Authentik app on Truenas from TrueCharts. It doesn't persist the postgres data and when I was trying to use it on Truenas, if I ever had to remove the container and re-add it, then it would reset Authentik to a Fresh Install, and I would have to set everything up again. Just be aware of this.

thorn leaf
#

idk my needs for the configuration here

drifting tree
#

dont name it bridge for authentik, it's a bridge you'll use (or should) for any docker/vm running inside truenas

thorn leaf
drifting tree
#

same difference for now 🙂

thorn leaf
#

should I add any bride members

#

or as default

drifting tree
#

what is listed in the member dropdown ?

thorn leaf
drifting tree
#

what do you see if you select the en0s3 as a member

grim mason
# thorn leaf Should I use truenas or truecharts?

As far as I know, TrueCharts is the only one with Authentik in its list of apps. I just moved away from using this container image because of the non-persistant postgres data. Unlike with standard docker where you can force this to be persisted.

thorn leaf
thorn leaf
drifting tree
#

you can ok out of there

thorn leaf
#

so no memebr?

#

or wdym ok

drifting tree
#

you need the interface to be a member otherwise any virtual interface using the bridge wont be able to get out of the truenas box

#

normally once the bridge is there, you would move the truenas IP to the bridge itself (and not the interface)

thorn leaf
#

so I sould selsect enp03s

drifting tree
#

yep

thorn leaf
#

I'll save now then

drifting tree
#

in the network interface menu when the bridge is created, you should be able to assign it a static IP on your internal network

thorn leaf
#

and test

drifting tree
#

and remove the one from the interface

#

(you can reuse the same)

#

is the truenas server a virtual machine or a physical box ?

#

or an appliance of some sort

thorn leaf
#

just wanted to manage and clone easily that's why

drifting tree
#

ok

#

it's a vm running on a vmware, hyper-v, proxmox or something else ?

thorn leaf
drifting tree
#

see .. virtual box uses a bridge 🙂

#

so the virtual box vm connect to your internal network

#

assuming you connected it 🙂

thorn leaf
#

yes I can access my truenas testing on my home network

drifting tree
#

is your home network also on 10.0.0.x ?

thorn leaf
#

if thats what you mean

drifting tree
#

or you natted

thorn leaf
#

same subnet i think

drifting tree
#

yeah .. this is what I mean 🙂

#

if it's 10.0.0.x / 24 (or 255.255.255.0) it's the same subnet

#

gives you 254 usable IPs

thorn leaf
#

my local ip is 10.0.0.225 and my pc is on 10.0.0.64

drifting tree
#

your router is 10.0.0.1 ?

thorn leaf
#

how did you know?

#

yeah that's the gatway on

drifting tree
#

well people usually use the .1 of their network subnet to put the default gateway

thorn leaf
#

so now:

#

?

#

did my interface disapear?

drifting tree
#

the br0 interface is not created ?

thorn leaf
#

I pressed save

#

ll try again

drifting tree
#

did you apply ?

#

isn't truenas queuing changes and you need to "apply" them when you are ready ?

#

I dont remember

#

being proactive here, 10.0.0.225 is your adguard dns server ?

thorn leaf
drifting tree
#

if your dhcp servers gives out the same DNS servers as the one in the screenshot (.225, .1 and 1.1.1.1) things wont always go well

#

and it means that some of your traffic will not be filtered by adguard

#

and if you setup a custom internal only domain name on adguard, it wont always work because machines could hit either of the 3 dns servers

thorn leaf
#

hmm

drifting tree
#

all this to say that you should have adguard as your only dns server on any machine for which you want the traffic to follow your adguard policies

thorn leaf
#

aww dang it I gtg now. sorry

#

mom needs me

drifting tree
#

np

thorn leaf
#

when will you be unavalibe?

drifting tree
#

just ping me, I'm never too far

thorn leaf
#

alright

#

thanks

drifting tree
#

np, I'll leave you with a bullet list of the next steps you should follow when you get back to your computer

#
  1. create the bridge
#
  1. move the ens0s3 ip address configuration to the bridge interface
#
  1. re-install the authentik machines (worker and server) and have them use the new bridge interface and assign them static IPs in your 10.0.0.x network
#
  1. pick any internal domain name you'll use now and forever
#
  1. configure static dns entries in your adguard box for that domain name so you have something like: immich.mynewdomain.internal, authentik.mynewdomain.internal (no need for a dns entry for the worker), jellyfin.mynewdomain.internal.
#
  1. make sure your DHCP configuration (the service handing out IPs in 10.0.0.x/24) is configured to only provide adguard as a dns resolver - creates a single point of failure for your client however, but there are ways to fix that). depending on what kind of router you are using right now there could be a way around this requirement)
#
  1. make sure you can access authentik via the authentik.mynewdomain.internal (browser)
#
  1. in authentik under system/certificates, generate a new entry for authentik.mynewdomain.internal (give it 3650 validity days so you dont need to fix every year)
#

9., shouldn't be needed

#
  1. download the new authentik certificate (not private key)
#
  1. now, because you can connect to authentik on port 80, you dont absolutely need a cert for the authentik web interface, however if you want to encrypt it: go to system / brands and modify the authentik-default and change the cert in the global settings section
#
  1. add the new fresh authentik.mynewdomain.internal public certificate that you created / downloaded to your windows machine trusted root
#
  1. in immich make sure you have a mount point and copy the public certificate you downloaded in there
#
  1. assuming you are configuring immich as a docker, you need to make sure you are passing it this environment variable: NODE_EXTRA_CA_CERTS=<path to your CA cert file> (the path needs to be the path visible to the docker from within), ie, you mounted /truenas/storagearray/immich to /config, then the value would be /config/certificatename
#
  1. once the immich server is rebooted, log into it and type "env", see if you have an entry in there NODE_EXTRA_CA_CERTS=whatever you put OR process.env.NODE_EXTRA_CA_CERTS
#

this should be it .. let me know

#

note. whenever you are referencing authentik or immich or any other systems, you should always use the DNS name you created (and make sure everything is configured with static IPs and that you document it (worth it trust me). For documentation if you dont have anything yet, you can look at netbox (free) or phpipam

#

hope this helps

thorn leaf
thorn leaf
#

adding as alias?

#

no

#

also 10.0.0.225 does not work to access anymore after these changes

#

settings

drifting tree
#

you need to assign the ip address to the bridge

thorn leaf
#

10.0.0.225?

drifting tree
#

put something else for now that isn't used, just to regain access to the web interface

thorn leaf
#

in the alias section?

#

I have never made network inteface before

#

so idk

drifting tree
#

then make sure you unassign .225 from the interface, and then change the temporary ip to 225

thorn leaf
drifting tree
#

ok

#

see if you can browse using 230

thorn leaf
#

can't browse it for some reason

drifting tree
#

one sec

thorn leaf
#

nw 😄

drifting tree
#

nw ?

thorn leaf
#

no worries

#

I can wait

#

😄

drifting tree
#

ok, assign 10.0.0.230/24 to enp0s3, change br1 and remove the member for the moment

thorn leaf
#

have to o again, terribly sorry

#

I ll fololow the list latyer

#

thanks 😄

drifting tree
#

you can try this after you've regained access: Set up your main interface with static IP by disabling DHCP and adding IP alias (use the same IP you are connected to for easy results) Test Changes and then Save them (important) Edit your main interface, remove the alias IP Don't click Test Changes Add a bridge, name it something like br0, select your main interface as a member and add the IP alias that you had on main interface Click Apply and then Test Changes It will take longer to apply than just setting static IP, you can even get a screen telling you that your NAS in offline but just wait - worst case scenario TrueNas will revert to old network settings. After 30sec you should see an option to save changes. After you save them you should see both your main interface and new bridge active but bridge should have the IP

#

so reading up a bit on truenas scale .. they changed things a LOT since I last played with it .. while truescale makes it rather easy to deploy things with some caveat, should work nevertheless

#

one of the reason why they suggest using the loadbalancer approach is that truenas scale is meant to setup redundancy / clustering and you couldn't easily do that without a loadbalancer in front of it

#

it seems like the only "proper" way of being able to assign "real" ips to the truenas scale is to switch from the build-in loadbalancer and use the app metallb instead

#

you could also scrap all this and setup a ubuntu server, install docker on it, use docker compose file (or add portainer docker to get web management) and go that route, if you installed truenas just to run the APPS, you'd have less headache going this way, if you need truenas for other purposes, then either split into two servers (truenas and ubuntu server) and be happy

#

in all cases, all the steps I provided are pretty much valid, so long as you have a working docker/ container of authentik and the right certs

thorn leaf
#

Idk, I stll can't access 10.0.0.230

thorn leaf
thorn leaf
#

@drifting tree Am I being dumb here. I can't find what have done wrong

drifting tree
#

remove the br0 interface, reapply the ip to the enp0s3 interface like it was originally

#

then you'll need to install the metalllb thing and go from there

#

truenas scale will not allow to make things easy

grim mason
#

Have you set the interface for the apps to use in the web ui? If not set it will use any interface and might not route correctly if multiple interfaces are being used. There are a lot of web ui settings that you will want to change most likely. Almost all of TrueNas Scale needs to be configured through the web ui

drifting tree
#

at this point the apps are not even in question, he doesn't have web ui access

#

seems like creating the bridge and moving an IP to it broke that (hence the undo)

grim mason
#

Sorry I haven't read through this whole thread as it has been pretty active and I haven't been sitting here reading it. lol. But if his main interface is on the network that is assigned by his router, if it is 10.0.0.230/24 then yea, i would assign this to the main interface. I don't have a bridge setup on my truenas scale vm server and apps work fine

#

or use dhcp temporarily to gain access to web ui again. note the Ip in the console that you are using, navigate to the dhcp address in a browser and set the settings in the web ui.

drifting tree
#

the biggest objective was to give the apps (authentik for one) a static IP on his 10.0.0.0/24 network

grim mason
#

if there are multiple interfaces installed into the truenas vm or machine, then you would want to set (most likely) the apps interface to communicate on.

drifting tree
#

he wants to use authentik as a SSO for jellyfin and immich (more after) and without a proper public domain having a static IP configured in his adguard with a fake internal domain name would work

#

again I haven't played with truenas scale recently, but being forced to use nat/pat for the apps is not that great ..

grim mason
#

Yea i don't see why that wouldn't work if Adguard or whatever DNS server he is using can resolve that name.

drifting tree
#

yup .. as long as the root ca is trusted ..

#

so is there an easy approach to give each apps a dedicated IP on the 10.0.0.0/24 subnet ?

#

or scale will not really allow that

grim mason
#

If he can gain access to truenas scale web ui again, then navigate to Apps > Settings > Advanced Settings and set the Node IP, Route V4 Interface and Gateway

#

the apps will use which ever interface by default that is defined here.

drifting tree
#

all I've seen so far was to stop using the internal built-in load balancer and install metallb

#

so you could give real IPs to apps

grim mason
#

I moved away from using authentik on truenas because i couldn't persist the postgres data and went to using docker compose.

drifting tree
#

couldn't map the proper storage mount point ?

#

I run my authentik on unraid ... I configured my postgresql server on it's own as I use it for other apps anyway

#

same with redis

grim mason
grim mason
drifting tree
#

ok so you dont need to have all APPs use the same IP and use different ports for each of them ..

grim mason
drifting tree
#

bleh

#

that's what I dont like at all

#

and what metallb is supposed to fix

grim mason
#

the only way around this that i found is by installing a vm on truenas scale with ubuntu server or use proxmox and run truenas in a vm along side multiple other vms. lol

drifting tree
#

it wouldn't matter much for all the apps to use the same IP if there was a reverse proxy in front looking at host headers and just redirecting ..

#

setup a caddy server or nginx or your favorite reverse proxy and at least you'd be able to connect to plex.myinternaldomain and sonarr.myinternaldomain without having to remember ports

#

is what I was refering to

grim mason
#

authentik has a transparent reverse proxy built in too.

drifting tree
#

there's supposed to be an app for that

#

yeah it does, but it's rather limited

#

then again he doesn't need letsencrypt automagic since nothing is opened to the internet

grim mason
# drifting tree https://metallb.universe.tf

I think i saw this when I was looking into a solution for this but I decided to just go a different route, as i think i thought it was too much work. lol. I moved all the apps i could from truenas to docker and kept only what was needed on truenas.

grim mason
drifting tree
#

all the eggs in the same basket isn't always the best, ... like me running uptime kuma on the server I need to monitor 🙂 I have an unused mikrotik router that I might repurpose to run the docker 🙂

#

yup .. as long as he adds the authentik self signed cert to all the required root trusted store .. he should be good .. might be worth regenerating it to last 10 years however

grim mason
#

I have 3 proxmox nodes all running individually, and uptime kuma runs on the one that is least powerful and least used. lol

drifting tree
#

I got some vms and lxc on proxmox running on a small intel NUC, got unraid running on my qnap (flushed the built-in OS) with bunch of dockers and I have a too powerful (and power hungry) server that is turned off that I dont need lol .. only sad thing is that it has 196gb of ram .. far more than my other boxes

grim mason
drifting tree
#

I have old gen dell r510 maxed out (a pair of the maximum supported cpu was like 50$ on aliexpress at the time) and another dual cpu tyan server (same gen of CPU) .. both are turned off .. the noise and power couldn't be justified by looking at how idle they were

#

I fool around with wayyy to much shit 🙂

grim mason
#

same here lol

#

I'm currently running about 55+ different applications throughout my homelab.

drifting tree
#

yeah .. sounds like me lol ... started to run out of IPs in some of my /24 lol .. had to install phpipam to scan my subnet so I dont need to hunt for free IPs

grim mason
drifting tree
#

gotta have a vlan for my kids so their traffic is forced through adguard, one for my stuff, one for IoT, one for camera, one for docker, one for all my home automation stuff (bunch of esphome, smart switch, bulbs, etc) .. at least all the zigbee and zwave stuff doesn't take network space 🙂

#

I almost have to hire someone to help me 🙂

grim mason
#

I have a friend who pays me to help with his homelab that he is just starting out with. lol

drifting tree
#

like drugs :p

grim mason
grim mason
thorn leaf
#

the real system is an i3 gen 12 32 gb ram and 24 tb hdd (12 tb mirror) + 1 tb nvme.

#

Oh damn you guys haven't had an conversation here

#

Where you from @drifting tree?

#

if you don't mind me asking ofc

drifting tree
#

I dont mind at all .. quebec canada..

#

native french speaker here

thorn leaf
#

that's cool

grim mason
thorn leaf
#

how about you pick it420

grim mason
thorn leaf
#

I'm from Europe

#

Sweden

grim mason
thorn leaf
#

I was originally going to run Truenas core inside a vm on proxmox but it seemed like a big hassle without an hba.

grim mason
grim mason
drifting tree
#

well you wouldn't like unraid then 🙂

thorn leaf
#

I am running TrueNAS bare metal now

drifting tree
#

pretty different approach

#

but you can mix and match any size of disks

grim mason
drifting tree
#

and add / remove

#

doh lol .. whatever you do, backup are needed ..

#

even if you have everyting in a raid 60

#

everything*

grim mason
#

Lol I have backups now with proxmox and a separate proxmox backup server

#

I would have my media library backed up, but it is about 60TB and i don't have another server with another 60TB available. So i just backup my Sonarr, Radarr, and Lidarr configs since these hold my media library collections. I also have unlimited internet so if needed, I will re download everything. lol

thorn leaf
#

idk if it exist in truecharts

drifting tree
#

I had about 90TB on google before they screwed us .. I switched back to on prem but had to downsize quite a bit sadly

#

metallb is supposed to be available as an APP

thorn leaf
#

how do you guys have so much to store

grim mason
#

Using Google was too slow for me too.

thorn leaf
#

my current synology nas is only 3 tb

grim mason
drifting tree
thorn leaf
#

So should I wait with the bridged interface?

drifting tree
#

to be honest, I barely saw a difference .. but here I have 1.5down 1.0 up ..

#

so bw is normally not an issue when it comes to dealing with cloud storage

#

I've been conditioning my mind over the fact that NOBODY is going to re-watch the 24 first seasons of survivor .. so I started to cut down so I could migrate back 🙂

grim mason
drifting tree
#

still funny that I actually work for Google 🙂

#

but we dont get discount on those services

#

I pay full price for my youtube premium family plan :/

grim mason
thorn leaf
drifting tree
#

with 160k ish employees, if they gave it away to all of us for free, it would nudge their income line lol

grim mason
#

Not saying for free, but a discount would be nice. even 10%.

drifting tree
#

nope.. we get an OK discount on the apparel and google things store

grim mason
drifting tree
#

nothing to call home about but still ..

#

I have to run for now .. I'll be back later

#

nice chatting with yall

grim mason
grim mason
thorn leaf
#

Does it give you individual ip addresses for apps?

#

or what does it accomplish?

grim mason
thorn leaf
#

That seems like the default configuration for apps in TrueNAS Scale...?

grim mason
#

All the apps in truenas will use a single IP address (if assigned in the pic) or it will use all interfaces available and just pick which one it wants to use.

#

Which might not be the one you want it to communicate on

grim mason
thorn leaf
#

so it can't pick another

grim mason
# grim mason No, it uses a single IP address and different ports

This is similar to how docker works. You run docker on a single machine which it will share a single IP address. But then you define different ports that the services use to communicate on that single IP address so you can host multiple different apps from a single machine.

thorn leaf
#

or?

grim mason
thorn leaf
thorn leaf
grim mason
#

Same concept with TrueNas Apps. Just slightly different.

#

@ me if you want faster help. I can send screenshot and walk you through exactly what I did to get Apps working on TrueNas Scale.

thorn leaf
#

But would I not need separate static IP for authentik, to get it to work properly?

grim mason
#

If you can access the Truenas Web UI from this IP thats all you need.

thorn leaf
#

But Authentik with immich (Oauth) wasn't working

grim mason
#

It could have been because the apps interface wasn't set. This did cause issues with me when first trying to use Authentik, and a single Interface.

thorn leaf
#

This was my original question, a while back #general message

grim mason
#

It shouldn't need a real domain as I have used a private address before when testing it.

#

Inside TrueNas, you might need or want to set the network global configuration.

thorn leaf
#

It is just this error I recive in immich: error in OAuth discovery: Error: self-signed certificate

thorn leaf
grim mason
#

Have you tried importing this certificate into Immich to be recognized as the default cert that Authentik creates?

thorn leaf
grim mason
thorn leaf
thorn leaf
grim mason
#

Login to TrueNas Admin Web > Network > Click Settings on the Right side of Global Configuration

grim mason
# thorn leaf How do I do that?

Sorry I don't use Immich so I don't know where the certs will be located on that, but In Authentik, you can Navigate to System > Certificates > Expand the authentik Self-Signed Cert > Click Download Certificate and Key > Save each of these into a text document with the file extension as .pem.

Then, theorectically, you should be able to copy these or upload these to the directory that immich uses for certificates. You should be able to rename these the same as the ones Immich currently uses so it will think it's the self signed one that it created and then maybe restart Immich.

#

This should trick Immich into thinking that the cert is signed by Authentik and not by Immich's self signed.

I'm not exactly sure if this will work or if it will break the login for Immich. If you dont want to go this route, you could try to change the config for Immich to point to the new certs instead of overwriting the originals.

I would also recommend making a backup of the original certs from Immich before overwritting the originals just incase the Self Signed ones from Authentik break the Immich Login page.

#

Since you are wanting to run this on just a local network with PiHole or Adguard as your DNS, and Authentik is going to be your "Signing Authority" instead of Let's Encrypt or Cloudflare, then in theory you will need this Authentik Self Signed cert on anything you will want OAuth to be working on, and you will also need to select this Authentik Self Signed Cert under any Authentik Provider you Create.

thorn leaf
#

or a web ui

#

or access to yaml files

thorn leaf
#

I don't know how much of pure config file trueNAS scale will allow me to edit either

#

I mean metallb

grim mason
#

There might be a way to config files for apps, not guaranteed to stick after restarting but, if you were to store the data from the app in a truenas pool folder and then share that folder or pool over smb to access it from your pc.

I dont use metallb so I'm not sure about this. I run very basic apps on my truenas that handle media management and thats it. Everything else runs in docker or a vm

thorn leaf
#

maby @drifting tree has an idea here

#

because I don't think information will stick after restarting in smb as you mentioned

#

read that in an documentiaion somewhere iirc

#

I would really like to have dns rewrites or what it is called so I can have auth.mydomain.internal instead of an ip

grim mason
#

Yea I found that quite a few apps from TrueCharts don't persist databases without extra work being done. Thats why I moved away from using most apps on Truenas and now just use it as a one time testing platform before trying to install into a vm or docker.

thorn leaf
#

yoo

#

i got this to work now:

image.png
#

weirdly

#

I used the same settings before and in the gui

#

well, idk if it is right tho

thorn leaf
#

I am no networking expert

#

idk what I am doing at this point

#

should I use traefik?

#

or caddy, nginx prox

grim mason
# thorn leaf i got this to work now:

For me, like I said before, I don't have a bridge network attached to my TrueNas Scale VM. I just have 1 interface and that is also attached to the apps.

thorn leaf
#

do you happend to know what I put ingress as, It is required to have an ingress

grim mason
#

I don't see why this wouldn't work though if you attach the bridge network to the apps.

thorn leaf
grim mason
# thorn leaf

That's new to me, I've never had to enable or use that

thorn leaf
#

Seems like I need to use a domain afterall?

grim mason
#

It is the easiest way to setup authentik

thorn leaf
#

Just seem like it was unecceary, when I only run it locally

grim mason
thorn leaf
grim mason
#

That's why I just have most apps on Docker now. TrueNas made it too hard to configure some apps properly or mount certain locations.

I do know that If you had a storage pool on Truenas, then create a Dataset for the apps to live in, I personally created seperate datasets for each App I installed on Truenas with sub-datasets for like the config or whatever else the app needed to mount. Then I would install the app into those directories by choosing to pass through the mount points to these folders. I then shared the parent dataset for these apps over SMB to access from my personal PC. From here, I was able to gain access to whatever the app would install. Sometimes it would have config files, other times it wouldn't

grim mason
#

So my apps structure looked something like:

- Apps
    - Sonarr
        - config
    - Radarr
        - config
#

Then I SMB shared the Apps Dataset

drifting tree
#

I see no reason why authentik wouldn’t work with a fake internal domain

#

And repeating myself. All you need is for the apps to trust authentik certificate

#

The flow is simple. The user talks to the target website. The website asks to validate the user. A ticket is granted and the site uses that (hence the trust part) let’s the user go through

drifting tree
#

I just configured immich with oauth (with an external domain) .. pretty easy .. should be easy without one as well

grim mason
drifting tree
#

I saw something about that

#

NODE_EXTRA_CA_CERTS=<path to your CA cert file>

#

if you can add this environment variable to the immich server

thorn leaf
#

hmm

drifting tree
#

btw you made me discover immich, I've configured it without issues to use my authentik as sso (however I have a public domain), but no reason why what I've mentionned to you wouldn't work

grim mason
#

Same here. I started using it now too, and also have sso setup with local ip address, mobile and domain name.

thorn leaf
#

and Idk where my authentik cert file is located in the file system

thorn leaf
drifting tree
#

So the authentik cert that you need to trust in immich can be downloaded directly from authentik web page.

thorn leaf
#

but how do I uploade it back to the NAS

#

and where would it be uploaded too

#

for immich access

thorn leaf
#

hello again 🙂

drifting tree
#

hi

thorn leaf
#

I am clueless what to do

drifting tree
#

so step 14 15 16 way above cover that

thorn leaf
#

😦

drifting tree
#

put the certificate file somewhere on the nas, make sure that the volume is mounted to the immich application so you can access the certificate from within immich. then configure the environment variable mentioned to trust that certificate

thorn leaf
drifting tree
#

let me check

thorn leaf
#

I am still clueless, because this is not environment variable for the certificate?

drifting tree
#

let me configure a VM real quick with truenas to see the menu options

thorn leaf
#

with TrueNAS scale then

drifting tree
#

in the meantime, save the certificate you got from authentik in an existing (or new one just for that) share on truenas

drifting tree
#

immich is deploying right now

thorn leaf
#

ok

thorn leaf
drifting tree
#

ok good

thorn leaf
#

that path would be

drifting tree
#

it'll be a sec, I'm trying to get apps to go pass the deploying status

thorn leaf
#

cert/cert_file.pem

drifting tree
#

you might need to put a / in front of the mount path .. not sure

#

and you should use /opt/certdata

thorn leaf
thorn leaf
thorn leaf
drifting tree
#

oh I see my problem, I need to set a static IP instead of dhcp ..

#

changing tha t

thorn leaf
#

let me know if I can assit you 😄

drifting tree
#

ip assigned ..

#

just waiting for apps to become ready again

thorn leaf
#

wait, are you using metallb?

drifting tree
#

not right now

#

I dont need it for my current test

drifting tree
#

OK

#

so the issue right now is that the prebuild app wasn't set to allow inputing any environment variable (I've seen this available by looking at some random other apps in the prebuilt list). It wouldn't stop you from getting into the docker console and adding the necessary variable, however it wont survive an application update

#

either you live with that, you look at all the settings from this one and create a custom one using the same setting while adding the environment variable or you can get whoever is the truenas immich maintainer to add the option for env variables

#

this is what's missing:

thorn leaf
drifting tree
#

oh yes, it's an option that you have when you build an app ... however, whoever built this one didn't include it .. so they'd have to change it

thorn leaf
#

Okay

drifting tree
#

why did you say you picked truenas scale as your choice ?

thorn leaf
#

because I thought it would be a good software for NAS and some apps

drifting tree
#

have you looked at other options ?

#

like openmediavault, unraid, freenas ?

thorn leaf
#

Not really

drifting tree
#

now unraid is a beast on it's own .. the way it handles data / raid is quite different, however it allows you to mix and match any size hard drive and still have redundancy. Openmediavault is pretty decent and runs on top of a normal linux debian backend and if you add the openmediavault addons you can use normal dockers

#

freenas is a bit more out there in terms of UI and device support because it runs on freebsd

#

unraid however isn't free. This is what I use, but I've played with OMV also

thorn leaf
thorn leaf
#

@drifting tree ?

#

you see something wrong with it?

drifting tree
#

did you do /opt/certdata earlier or /opt ? (just make sure that matches)

#

and it wont harm anything to try

thorn leaf
thorn leaf
#

I get this error:

#

I have given up on not using domain

drifting tree
#

dont give up.. you are almost there

#

auth.whateveryouused should be resolvable by immich. make sure it's the case (you should be able to open a shell prompt to validate).

thorn leaf
#

@drifting tree and @grim mason I got it working

#

😄

grim mason
#

Yay!

thorn leaf
#

I have issues with Nextcloud tho

#

It does not work with OpenID backen user

thorn leaf
grim mason
#

Look at my gitlab for the documentation I have. But it does work with that.

Lazy Media's Public Gitlab Files

From your pic, uncheck unique user id, and check the box for group provisioning, then fill in groups in the scope for groups above the check boxes

Have you also looked at the authentik documentation for that?

GitLab
Public Files / Public Files · GitLab

GitLab Enterprise Edition

thorn leaf
#

and there is supposedly nothing wrong with reaching the domain for nextcloud. if there is no other setting in nextcloud idk.

image.png
grim mason
#

Do you have https enabled/forced for nextcloud in your nextcloud config?

#

Are you also using the custom scope mapping provided by authentik? If so you don't have that in nextcloud scopes.

grim mason
#

also, just to make double sure, I see the discovery endpoint has nextcloud as the slug, do you also have a standard application and provider that points to nextcloud with the same slug? it could be an issue but not exactly sure. For me personally, when I create a standard application and provider, i will input the slug as the name of the application, and when creating an oauth provider, i make the slug the name of the app followed by -oauth just to keep things smooth and easy to remember and to not have Authentik try to communicate on the wrong endpoints.

#

And from the pic for your nextcloud setup, it doesn't look like you actually have any scopes filled in, it looks like it is empty with a placeholder for what should be input there. But maybe it's just the picture.

thorn leaf
grim mason
thorn leaf
#

@grim mason

#

I have sent my information here if you can see it idk

grim mason
#

Haha, yea I am a part of that server too so I did see it.

So you are using this on truenas. Do you have access to the config folder via SMB? If you installed it to the ix-systems or default config path, you should change this to its own dataset and try to smb share it so you can access it. You might have to spin down nextcloud, change permissions to your user, access via smb, edit the config.php file, change permissions back to www-data or whatever user and group it gets assigned, and then start nextcloud again.

grim mason
thorn leaf
#

My server started sounding horrible

#

the hdd

#

after I forced turned it off

grim mason
thorn leaf
#

the hdd constantly sound

grim mason
# thorn leaf the hdd constantly sound

Just being funny, but don't they usually make sound when powered on? Lol. But I understand what you are saying. Time to replace a hdd. I have one thats dying on me in my TrueNas server too but its also a WD hdd instead of Seagate.

thorn leaf
#

This is the sound

#

listen to it fully as it's not constantly constantly sounding constantly

grim mason
#

To me it sounds like a dying hdd or the reader head got stuck inside...but it is a little hard to hear it. Did truenas show any errors?

grim mason
# thorn leaf

That doesn't sound good though. Playing it through my phone I could hear it better.

thorn leaf
#

no

thorn leaf
grim mason
thorn leaf
#

they are enterprise ones

#

Should guaranty cover this if they are dead?

grim mason
#

Yes the manufacturer warranty should cover it. You could also try to power down the server, or take out the hdd in question and toss it into your personal pc and run some tests on it, or maybe install Scrutiny on to truenas, but this gives more detailed SMART results, doesn't do anything else. If your pool is sufficient to run without the hdd in question, obviously in a degraded state, you could try to pull the hdd, format it on your personal pc and then replace it with the same disk in truenas. when you format it on your personal pc, it should show up as a new drive in Truenas, and then just choose Replace.

For me, I only know I have a failing HDD because Truenas shows 1 disk with an error and the error count increases. But I honestly don't think it's my hdd that's failing. I think it has to do with HBA or the backplane that is in the hdd bays.

thorn leaf
#

oh ok

drifting tree
#

hard disk either last a few weeks/months, or they last 5+ years

thorn leaf
#

I already had that enabled

#

@grim mason 😄

#

How do I fix nextcloud Oauth );

#

maby this helps:

image.png
#

in nextcloud logs

grim mason
# thorn leaf

Are using the scope mapping not that is provided by authenik?

I would still enable the group provisioning and type group in the attributes box

You also shouldn't need any extra attribute mappings

thorn leaf
# thorn leaf

I use what is here, I did not create anything other custom for groups or scopes as I do not require storage quotas. ( as it said in the authentik setup guide afaik )

#

I don't see how changing those would help solving "discvoery enpoint not reachable"

#

I belive there is some network setting in nextcloud that is stopping it

#

specifically dns

#

But I did test the reachabilty of authentik using the pods shell and it was successful

#

or perhaps could it be that I need to add the authentik domain to trusted domains

thorn leaf
#

no fucking way I got seafile to work with Oauth after many tries

grim mason
# thorn leaf

Is this picture for the nextcloud oauth provider above it? If so, do you have another provider for nextcloud with the same slug?? You should have 2 applications and 2 providers, 1 for nextcloud to route correctly, and 1 for the oauth.

I also now see that the authentication flow is enabled in the pic above too. I usually don't have that set.

thorn leaf
#

the two picture I sent is the nextcloud Oauth provider (upper one) and then the nextcloud application (lower one)

grim mason
thorn leaf
#

I was never told to do something like that in the authentik guide

#

was I?

grim mason
#

Not that I know of but its something I found in the nextcloud docs.

thorn leaf
#

I saw it too but I ignored it as It has worked without any issues on immich

#

Maby I should take a look at it

#

Let me do that

#

sorry

grim mason
#

Yea nextcloud is more robust and security happy from what I could tell so you need to tell nextcloud everything that is allowed to it.

#

No need to be sorry. We are all here to help each other.

#

I had to add the trusted proxies to nextcloud before I could get it to work

thorn leaf
#

I am using traeifk but I can't understand where I am supposed to add these:

image.png
#

Wait

#

I asked somone in truecharts and they said those were already baked into helm

grim mason
#

It shouldn't be in traefik, it would be in your nextcloud config file.

It would be a command something like this:

nextcloud.occ config:system:set trusted_proxies 0 --value=auth.domain.example

It show up as an array in the nextcloud config.

#

I can send you an example of what my config looks like in nextcloud so you can compare. Just give a little bit to get back to my computer

#

So in my nextcloud config file, even when I had it on TrueNas, I had to add these to it to get Authentik to work correctly, this is also when I tried a different authentication method, SAML, other than OpenID

Trusted Domains = IP address or domain name for Nextcloud
Trusted Proxies = IP address or domain name for Authentik
Not sure if the forwarded for headers is required but I have it there.

  'trusted_domains' => 
  array (
    0 => '127.0.0.1',
    1 => '192.168.1.20',
    2 => 'nextcloud.domain.example',
  ),
  'trusted_proxies' => 
  array (
    0 => '192.168.1.10',
    1 => 'auth.domain.example',
  ),
  'forwarded_for_headers' => 
  array (
    0 => 'HTTP_X_FORWARDED',
    1 => 'HTTP_FORWARDED_FOR',
  ),
thorn leaf
grim mason
#

Tha's fine, just change accordingly

thorn leaf
#

does your proxy run on auth....?

grim mason
#

yes

thorn leaf
#

so ngninx runs on the domain auth.domain.tld?

grim mason
#

I only run Authentik as my proxy so i have a CNAME set for auth.mydomain.example that points directly to Authentik

thorn leaf
#

I got it to work

#

I used another plugin

#

called OpenID connect login