[Feature] Support providing OAuth client ID and secret via environment variables

[joschi]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

Support providing the OAuth client ID (config: oauth.clientId) and OAuth client secret (config: oauth.clientSecret) configuration settings via environment variables (OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET), including *_FILE handling in server/bin/start.sh similar to other sensitive configuration settings such as DB_PASSWORD and REDIS_PASSWORD.

This enables Immich administrators to use Docker secrets, Kubernetes secrets, systemd credentials, and other similar file-based secrets for sensitive OAuth settings.

The feature should follow the already existing practice for configuration settings such as the database credentials and the Redis password.

Platform

• Server
• Web
• Mobile

[joschi]

#31349 was closed due to involving a coding agent.

[bo0tzz]

#14815

[joschi]

Thanks for linking to that discussion!

I'm just wondering about the inconsistency. Sensitive database settings can be provided by pointing to a file (for example DB_PASSWORD_FILE). Sensitive OAuth settings cannot be provided like that.

https://docs.immich.app/install/environment-variables#secrets

[bo0tzz]

That was already addressed in that thread: #14815 (reply in thread)