Skip to content

media_acquisition: switch seerr to OIDC fork

jedmund requested to merge worktree-media-acquisition-seerr-oidc into main

Created by: jedmund

Summary

  • Switches Seerr from ghcr.io/seerr-team/seerr:latest to ghcr.io/v3djg6gl/seerr:feat-oidc-jellyfin-quickconnect
  • This fork adds OIDC authentication (from upstream PR #1505) and Jellyfin Quick Connect support
  • The fork is 85 commits ahead of upstream develop and was last synced April 28, 2026
  • Both features are entirely opt-in — existing local/Jellyfin auth is unchanged

Notes

The fork uses the older OIDC implementation (upstream PR #1505, closed) rather than the newer PR #2715 currently under review. When upstream eventually ships OIDC, migrating back will require reconfiguring providers in the admin UI. No breaking changes to the current setup.

Plex account linking is not automatic. The fork's OIDC flow looks up users by email but raises a 409 conflict if a matching account already exists, rather than auto-linking. Existing Plex users must log in via Plex first, then manually link their PocketID account from profile → Linked Accounts. Only after linking can they use OIDC to sign in.

Post-deploy setup

To enable OIDC with PocketID:

  1. Create a Seerr application in PocketID (https://id.atelier.house), set redirect URI to https://{seerr-host}/login?provider={slug}&callback=true
  2. In Seerr admin → Settings → Users: enable "OpenID Connect sign-in" and add provider with issuer URL, client ID/secret, scopes openid profile email
  3. Notify users to log in via Plex once, then link their PocketID account under profile → Linked Accounts

Test plan

  • Deploy with deploy/media_acquisition.yml
  • Confirm Seerr starts and passes healthcheck
  • Confirm existing Jellyfin auth still works
  • Configure OIDC provider in admin UI and verify login flow

Merge request reports