[Guide] OAUTH with Google and NGINX

[berti77]

Note: This guide exist because the of Cloudflare 100mb limit. As the official documentation states for reverse proxyies "Immich is under very active development and the existence of severe security vulnerabilities cannot be ruled out."

I will only show the OAUTH part i assume you already have a working reverse proxy.

GUIDE:

Go to https://console.cloud.google.com/ and make a new project.

Follow the video until the "Authorized redirect URI" part:
https://youtu.be/TjMhPr59qn4?si=lDhzDOgYdNmxyo39

Find Google Auth Platform and open it.
The only important setting in this page is to make the audience EXTERNAL.

In Audience tabb add an email for testing.

Next go to Data Access and add EMAIL, PROFILE, OPENID.

Go to Clients page and add a new client.

At the Authorized redirect URIs you need to add 3 urls.

(replace "your.immich.url" with your url obviously)

https://your.immich.url/auth/login
https://your.immich.url/user-settings
https://your.immich.url/api/oauth/mobile-redirect

Click save and copy your Cliend ID and Client secret.

Go to immich:

Go into Administration/Settings/OAuth Authentication

ISSUER_URL: https://accounts.google.com
CLIENT_ID: you just copied it in the last step
CLIENT_SECRET: you just copied it in the last step
Leave the other setting as default.
Auto register: I recommend turning it off, if you have it on anybody with a google account is able to register.
Mobile redirect URI override: ON
Mobile redirect URI: https://your.immich.url/api/oauth/mobile-redirect

Save and test it.

If its working, publish your Google Auth app so it works with emails other than the one you entered for testing.
If you are sure it's working you can disable login with email and password that should make your immich safer.

NOTES:
If you have turned off Auto register you have to add every user you want allowed into immich. Existing users with gmail accounts should automatically link up.