From d7aaed393d5ab61468014ee56d2e3393d23beeb7 Mon Sep 17 00:00:00 2001 From: clover caruso Date: Mon, 5 Jan 2026 20:33:28 -0800 Subject: [PATCH] feat: jellyfin with sso so this doesn't setup automatic installation of the provider within jellyfin. i frankly do not care enough to get that part of the auth implemented. --- .env.example | 1 - compose.yaml | 6 +++--- config/jellyfin/branding.xml | 31 +++++++++++++++++++++++++++++-- config/keycloak/init.py | 35 ++++++++++++++++++++++++++++++++++- config/postgres/init.sh | 1 - 5 files changed, 66 insertions(+), 8 deletions(-) diff --git a/.env.example b/.env.example index 593265bafe329cba4601bec2312ca8e77fb3c448..fe59135e0b990e56e126a0b5fc14206f0371892d 100644 --- a/.env.example +++ b/.env.example @@ -21,7 +21,6 @@ POSTGRES_PASSWORD= POSTGRES_PASSWORD_AUTHELIA= POSTGRES_PASSWORD_FORGEJO= POSTGRES_PASSWORD_DAWARICH= -POSTGRES_PASSWORD_JELLYFIN= POSTGRES_PASSWORD_LLDAP= CLOVER_SOT_KEY= diff --git a/compose.yaml b/compose.yaml index fceb9a8fb94900dacaada8af360df98e79835c6d..76a2867402d0d01835e8bd2a8898b90d3b0a0370 100755 --- a/compose.yaml +++ b/compose.yaml @@ -56,8 +56,6 @@ services: condition: service_started postgres: condition: service_healthy - redis: - condition: service_healthy healthcheck: test: - "CMD-SHELL" @@ -242,6 +240,9 @@ services: net.paperclover.list.domain: jelly net.paperclover.list.priority: 110 net.paperclover.list.access: media + depends_on: + keycloak: + condition: service_healthy navidrome: # port 4533 container_name: navidrome image: deluan/navidrome:latest @@ -384,7 +385,6 @@ services: POSTGRES_PASSWORD_FORGEJO: "${POSTGRES_PASSWORD_FORGEJO:?}" POSTGRES_PASSWORD_KEYCLOAK: "${POSTGRES_PASSWORD_KEYCLOAK:?}" POSTGRES_PASSWORD_DAWARICH: "${POSTGRES_PASSWORD_DAWARICH:?}" - POSTGRES_PASSWORD_JELLYFIN: "${POSTGRES_PASSWORD_JELLYFIN:?}" volumes: - "${APP_ROOT}/pg_data:/var/lib/postgresql/data/" healthcheck: diff --git a/config/jellyfin/branding.xml b/config/jellyfin/branding.xml index 1edaeb907b0fbf2362d0dd7c47d4cd029460855a..3a596e080e2890b6bb7d459d428a8ad11acbe068 100644 --- a/config/jellyfin/branding.xml +++ b/config/jellyfin/branding.xml @@ -1,7 +1,34 @@ - and then we knew, just like paper airplanes: that we could fly. - + <form action="/sso/OID/start/snow" id="snow-sign-on-form"> + <h2>you are not logged in...</h2> + <button class="raised block emby-button button-submit snow-sign-on"> + snow sign on + </button> +</form> + +and then we knew, just like paper airplanes: that we could fly. + .loginDisclaimer {width:100%} +.manualLoginForm, .visualLoginForm, .btnForgotPassword { display: none; } +.btnQuick {text-transform:lowercase;margin-top: 150px;display:flex} +#loginPage .emby-button { background: var(--hover-background); width: 100%!important; max-width: 400px!important; margin-left: auto; margin-right: auto; border-radius: 8px; } +#snow-sign-on-form {transform: translateY(-208px) } +.snow-sign-on { display: flex; align-items; center; justify-content: center } +.snow-sign-on:before, .btnQuick:before { +display: block; +content: " "; +width:24px; +height:24px; +margin-right: 0.5rem; +} +.snow-sign-on:before{ +background:url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTEwIDIwTDguNzUgMTcuNUw2IDE4TTEwIDRMOC43NSA2LjVMNiA2TTE0IDIwTDE1LjI1IDE3LjVMMTggMThNMTQgNEwxNS4yNSA2LjVMMTggNk0xNyAyMUwxNCAxNU0xNCAxNUgxME0xNCAxNUwxNS41IDEyTTEwIDE1TDcgMjFNMTAgMTVMOC41IDEyTTE3IDNMMTQgOU0xNCA5TDE1LjUgMTJNMTQgOUgxME0xNS41IDEySDIyTTIgMTJIOC41TTguNSAxMkwxMCA5TTEwIDlMNyAzTTIwIDEwTDE4LjUgMTJMMjAgMTRNNCAxMEw1LjUgMTJMNCAxNCIgc3Ryb2tlPSJ1cmwoI3BhaW50MF9saW5lYXJfNTQ4XzE5KSIgc3Ryb2tlLXdpZHRoPSIzIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPHBhdGggZD0iTTEwIDIwTDguNzUgMTcuNUw2IDE4TTEwIDRMOC43NSA2LjVMNiA2TTE0IDIwTDE1LjI1IDE3LjVMMTggMThNMTQgNEwxNS4yNSA2LjVMMTggNk0xNyAyMUwxNCAxNU0xNCAxNUgxME0xNCAxNUwxNS41IDEyTTEwIDE1TDcgMjFNMTAgMTVMOC41IDEyTTE3IDNMMTQgOU0xNCA5TDE1LjUgMTJNMTQgOUgxME0xNS41IDEySDIyTTIgMTJIOC41TTguNSAxMkwxMCA5TTEwIDlMNyAzTTIwIDEwTDE4LjUgMTJMMjAgMTRNNCAxMEw1LjUgMTJMNCAxNCIgc3Ryb2tlPSJ1cmwoI3BhaW50MV9saW5lYXJfNTQ4XzE5KSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl81NDhfMTkiIHgxPSI0IiB5MT0iLTIiIHgyPSIxOC41IiB5Mj0iMjUiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj4KPHN0b3Agc3RvcC1jb2xvcj0iIzIyM0Q5OSIvPgo8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMxNTQzOTIiLz4KPC9saW5lYXJHcmFkaWVudD4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDFfbGluZWFyXzU0OF8xOSIgeDE9IjEwIiB5MT0iLTMiIHgyPSIxOCIgeTI9IjI3IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNGMkUzRkYiLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjRjJGOEZGIi8+CjwvbGluZWFyR3JhZGllbnQ+CjwvZGVmcz4KPC9zdmc+); +} +.btnQuick:before{ +mask-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJsdWNpZGUgbHVjaWRlLXNoaWVsZC1lbGxpcHNpcy1pY29uIGx1Y2lkZS1zaGllbGQtZWxsaXBzaXMiPjxwYXRoIGQ9Ik0yMCAxM2MwIDUtMy41IDcuNS03LjY2IDguOTVhMSAxIDAgMCAxLS42Ny0uMDFDNy41IDIwLjUgNCAxOCA0IDEzVjZhMSAxIDAgMCAxIDEtMWMyIDAgNC41LTEuMiA2LjI0LTIuNzJhMS4xNyAxLjE3IDAgMCAxIDEuNTIgMEMxNC41MSAzLjgxIDE3IDUgMTkgNWExIDEgMCAwIDEgMSAxeiIvPjxwYXRoIGQ9Ik04IDEyaC4wMSIvPjxwYXRoIGQ9Ik0xMiAxMmguMDEiLz48cGF0aCBkPSJNMTYgMTJoLjAxIi8+PC9zdmc+); +mask-size:cover; +background:var(--main-text); +} true /config/upload/splashscreen-upload.jpg diff --git a/config/keycloak/init.py b/config/keycloak/init.py index 42b8a8307f6185a9d98bc2b7ead4f71c9ad62253..d5fe1046c0a683f7f4b4fb9b11b9844d7768c26f 100755 --- a/config/keycloak/init.py +++ b/config/keycloak/init.py @@ -39,7 +39,7 @@ realm_config = { "replyToDisplayName": "clover caruso", "envelopeFrom": "", "host": env("MAILER_ADDRESS"), - "port": "587", + "port": "465", "ssl": "true", "starttls": "true", "auth": "true", @@ -161,6 +161,39 @@ def configure(): client_data = kc_admin.get_client(client_id) _ = Path("/shared/forgejo").write_text(client_data["secret"]) + # jellyfin + client_id = kc_admin.create_client( + { + "protocol": "openid-connect", + "clientId": "jellyfin", + "name": "Jellyfin", + "description": "", + "publicClient": False, + "authorizationServicesEnabled": False, + "serviceAccountsEnabled": False, + "implicitFlowEnabled": False, + "directAccessGrantsEnabled": False, + "standardFlowEnabled": True, + "frontchannelLogout": True, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "standard.token.exchange.enabled": False, + "oauth2.device.authorization.grant.enabled": False, + "oidc.ciba.grant.enabled": False, + "pkce.code.challenge.method": "", + "dpop.bound.access.tokens": "false", + "post.logout.redirect.uris": "*", + }, + "alwaysDisplayInConsole": False, + "rootUrl": "", + "baseUrl": "", + "redirectUris": ["*"], + }, + skip_exists=True, + ) + client_data = kc_admin.get_client(client_id) + _ = Path("/shared/jellyfin").write_text(client_data["secret"]) + # forward auth client_id = kc_admin.create_client( { diff --git a/config/postgres/init.sh b/config/postgres/init.sh index a1c1f068988c3e796d6f9d50ad038da120c3c414..d318d7d6446c7cacc1d46c414dba6a6ef7dbef65 100755 --- a/config/postgres/init.sh +++ b/config/postgres/init.sh @@ -45,7 +45,6 @@ ensure_db_user "clover" "$POSTGRES_PASSWORD" ensure_db_user "keycloak" "$POSTGRES_PASSWORD_KEYCLOAK" ensure_db_user "dawarich" "$POSTGRES_PASSWORD_DAWARICH" ensure_db_user "forgejo" "$POSTGRES_PASSWORD_FORGEJO" -ensure_db_user "jellyfin" "$POSTGRES_PASSWORD_JELLYFIN" printf "Everything is ready!" -- 2.54.0