security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

lib/config/index.ts

@@ -194,6 +194,10 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
         albumIds,
         sections,
         password: sp.password,
+        proofing: sp.proofing,
+        essayFile: sp.essayFile,
+        essayText: sp.essayText,
+        enabled: sp.enabled !== false,
         ...buildSubpageGrid(sp.grid),
       };
     });
@@ -204,6 +208,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
           name,
           slug: slugify(name),
           albumIds: value.map((entry) => processAlbumEntry(entry, `subpage "${name}"`)),
+          enabled: true,
         };
       }
       const sp = value as SubpageObjectValue;
@@ -215,6 +220,10 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
         subtitle: sp.subtitle,
         albumIds: albumEntries.map((entry) => processAlbumEntry(entry, `subpage "${name}"`)),
         password: sp.password,
+        proofing: sp.proofing,
+        essayFile: sp.essayFile,
+        essayText: sp.essayText,
+        enabled: sp.enabled !== false,
         ...buildSubpageGrid(sp.grid),
       };
     });
@@ -260,6 +269,7 @@ export function getConfig(): AppConfig {
       seo: {
         title: 'Setup Required',
         description: 'Please configure Immich Folio',
+        titleTemplate: '%s | Setup Required',
         noIndex: true,
         noFollow: true,
       },
@@ -271,6 +281,8 @@ export function getConfig(): AppConfig {
       legal: { enabled: false, name: '', address: '', zipCity: '', country: '' },
       map: false,
       transitions: false,
+      analytics: true,
+      proofing: { enabled: false, allowMailto: false },
       albumOverrides: {},
       albumDescriptions: {},
       albumPasswords: {},
@@ -296,6 +308,8 @@ export function getConfig(): AppConfig {
     albumHeroImages,
   } = deriveGallery(gallery);
 
+  const siteSeoTitle = settings.seo?.title || settings.title || env.SITE_TITLE || 'Gallery';
+
   return {
     immich: { apiUrl: `${apiUrl}/api`, apiKey },
     authSecret,
@@ -306,12 +320,13 @@ export function getConfig(): AppConfig {
     siteSubtitle: settings.subtitle ?? env.SITE_SUBTITLE,
     lang: settings.lang ?? 'en',
     seo: {
-      title: settings.seo?.title || settings.title || env.SITE_TITLE || 'Gallery',
+      title: siteSeoTitle,
       description:
         settings.seo?.description ||
         settings.subtitle ||
         env.SITE_SUBTITLE ||
         'A curated photography portfolio',
+      titleTemplate: settings.seo?.titleTemplate || `%s | ${siteSeoTitle}`,
       noIndex: settings.seo?.noIndex === true,
       noFollow: settings.seo?.noFollow === true,
     },
@@ -352,6 +367,13 @@ export function getConfig(): AppConfig {
     },
     map: settings.map === true,
     transitions: settings.transitions !== false,
+    analytics: settings.analytics !== false,
+    proofing: {
+      enabled: settings.proofing?.enabled !== false,
+      allowMailto: settings.proofing?.allowMailto !== false,
+    },
+    protection: settings.protection,
+    watermark: settings.watermark,
     albumOverrides,
     albumDescriptions,
     albumPasswords,

lib/config/schema.ts

@@ -14,6 +14,10 @@ export interface SubpageConfig {
   sections?: SubpageSectionConfig[];
   password?: string;
   grid?: Partial<GridConfig>;
+  proofing?: boolean;
+  essayFile?: string;
+  essayText?: string;
+  enabled?: boolean;
 }
 
 export interface SubpageObjectValue {
@@ -21,6 +25,10 @@ export interface SubpageObjectValue {
   subtitle?: string;
   password?: string;
   grid?: Partial<GridConfig>;
+  proofing?: boolean;
+  essayFile?: string;
+  essayText?: string;
+  enabled?: boolean;
   albums?: Array<
     string | Record<string, string | { title: string; description?: string; password?: string }>
   >;
@@ -68,7 +76,7 @@ export interface GridConfig {
   columns: number;
   gap: number;
   aspectRatio: string;
-  layout: 'masonry' | 'uniform' | 'showcase' | 'filmstrip' | 'editorial-flow';
+  layout: 'masonry' | 'uniform' | 'showcase' | 'filmstrip' | 'editorial-flow' | 'essay';
 }
 
 export interface AppConfig {
@@ -83,6 +91,7 @@ export interface AppConfig {
   seo: {
     title: string;
     description: string;
+    titleTemplate: string;
     noIndex: boolean;
     noFollow: boolean;
   };
@@ -94,6 +103,11 @@ export interface AppConfig {
   legal: LegalConfig;
   map: boolean;
   transitions: boolean;
+  analytics: boolean;
+  proofing: {
+    enabled: boolean;
+    allowMailto: boolean;
+  };
   albumOverrides: Record<string, string>;
   albumDescriptions: Record<string, string>;
   albumPasswords: Record<string, string>;
@@ -106,6 +120,16 @@ export interface AppConfig {
   rateLimitRpm: number;
   trustedProxyHops: number;
   needsSetup?: boolean;
+  protection?: {
+    disableRightClick?: boolean;
+    disableImageDrag?: boolean;
+  };
+  watermark?: {
+    enabled?: boolean;
+    text?: string;
+    opacity?: number;
+    position?: 'bottom-right' | 'bottom-left' | 'center';
+  };
 }
 
 export interface AlbumEntryObject {
@@ -131,6 +155,10 @@ export interface GalleryYaml {
           albums: Array<string | Record<string, string | AlbumEntryObject>>;
         }>;
         password?: string;
+        proofing?: boolean;
+        essayFile?: string;
+        essayText?: string;
+        enabled?: boolean;
         grid?: {
           columns?: number;
           gap?: number;
@@ -147,12 +175,18 @@ export interface SettingsYaml {
   seo?: {
     title?: string;
     description?: string;
+    titleTemplate?: string;
     noIndex?: boolean;
     noFollow?: boolean;
   };
   exifOnHover?: boolean;
   map?: boolean;
   transitions?: boolean;
+  analytics?: boolean;
+  proofing?: {
+    enabled?: boolean;
+    allowMailto?: boolean;
+  };
   theme?:
     | string
     | {
@@ -173,6 +207,16 @@ export interface SettingsYaml {
   };
   footer?: FooterConfig;
   legal?: Partial<LegalConfig>;
+  protection?: {
+    disableRightClick?: boolean;
+    disableImageDrag?: boolean;
+  };
+  watermark?: {
+    enabled?: boolean;
+    text?: string;
+    opacity?: number;
+    position?: 'bottom-right' | 'bottom-left' | 'center';
+  };
 }
 
 export function slugify(name: string): string {

lib/config/theme.ts

@@ -72,7 +72,7 @@ export const VALID_HERO_STYLES = [
   'typographic',
   'mosaic',
 ];
-export const VALID_LAYOUTS = ['masonry', 'uniform', 'showcase', 'filmstrip', 'editorial-flow'];
+export const VALID_LAYOUTS = ['masonry', 'uniform', 'showcase', 'filmstrip', 'editorial-flow', 'essay'];
 
 export function resolveTheme(raw?: SettingsYaml['theme']): ThemeConfig {
   if (!raw) return { ...THEME_PRESETS.studio };