From 6dc69b59c6b8eb3f296e8743ee3518d2a679237c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= Date: Sat, 6 Aug 2022 16:07:29 +0200 Subject: [PATCH] feat: add immich --- home-server.nix | 2 + secrets/immich/.env.age | Bin 0 -> 644 bytes secrets/secrets.nix | 3 +- services/immich.nix | 123 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 secrets/immich/.env.age create mode 100644 services/immich.nix diff --git a/home-server.nix b/home-server.nix index 93cb1cb..4ae0398 100644 --- a/home-server.nix +++ b/home-server.nix @@ -24,6 +24,7 @@ in with builtins; { ./services/mosquitto.nix ./services/home-assistant.nix ./services/owntracks.nix + ./services/immich.nix ./services/miniflux.nix ./services/paperless.nix ./services/nextcloud.nix @@ -82,6 +83,7 @@ in with builtins; { "cloud.felschr.com" "office.felschr.com" "media.felschr.com" + "photos.felschr.com" "books.felschr.com" "news.felschr.com" "mqtt.felschr.com" diff --git a/secrets/immich/.env.age b/secrets/immich/.env.age new file mode 100644 index 0000000000000000000000000000000000000000..25aa5b130392bbe834678d4900d324a7008232e7 GIT binary patch literal 644 zcmZ9_JB!l*003ZJ1T(5QIAu5=5ZdO^CN1hg+e_25Y0^j9ra_Rrnlw$C=Fv2XsBp+_ zx_CG#cq)hBbhwDZIq4$ea5vm=po1JPCpajAczCY&{ee%?wUjndym%UnoJrd8^h}5V zsYTHDjg+RMxg1gexuV!IieRFZ!sa-J%&O5=vmzpe8Je+eQpt@k(j z5_+OfhxE~nKu0Dq2SvUE35-<}#G#d2Qt+Bq7=%WW1ZLYZ5{#2`N|WTBz-qMsvZK^= ztdS+!dM}Y!D3Bp0s<*3w5Jqkgsl*Iv_lptJ^z#2V>+*#tPHZHldz$2H;FU^x)CA9y z5)0zBvWZ-6fY?p$MiU5TY}@VkGkHtQqY&exbcFcRvF;9?!jx30It&r{=?s&bY%gwP zVzgU^X^}^9(beg?paJeYrlzX5WatCWR9IW>+QujoMT}GOfmA95wsE0Cbj&gRHH)uQx7j?0tH&13%sT{xiI{_4nl0gPrQy z!W+zbxsP5vi#{wLKOyy(Kku(BrdKK9&m;I7cSe4`{_D%;+taT;R*&5W=gPvie0%%x e`)kXm(m&qqUcb94pL?+K?AGqy7JTsG#qWPeaOUm+ literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 2d054df..dc6a33d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -4,7 +4,7 @@ let "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbQpMo1JOGk59Rzl6pVoOcMHOoqezph+aIlEXZP4rBu"; users = [ felschr ]; - # `ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key` + # `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key` home-pc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFTQvIcSdhEKl/Kq+pcS/cPCyyZ1ygj+djfuaXzaRMx"; home-server = @@ -27,6 +27,7 @@ in { "miniflux.age".publicKeys = [ felschr home-pc home-server ]; "paperless.age".publicKeys = [ felschr home-pc home-server ]; "nextcloud/admin.age".publicKeys = [ felschr home-pc home-server ]; + "immich/.env.age".publicKeys = [ felschr home-pc home-server ]; # home-server "home-server/hostKey.age".publicKeys = [ felschr home-server ]; diff --git a/services/immich.nix b/services/immich.nix new file mode 100644 index 0000000..692335a --- /dev/null +++ b/services/immich.nix @@ -0,0 +1,123 @@ +{ config, lib, pkgs, ... }: + +let + uploadDir = "/var/lib/immich/upload"; + dbuser = "immich"; + dbname = "immich"; + ociBackend = config.virtualisation.oci-containers.backend; + containersHost = if ociBackend == "podman" then + "host.containers.internal" + else + "host.docker.internal"; + domain = "photos.felschr.com"; + + immichEnv = { + environment = { + NODE_ENV = "production"; + DB_HOSTNAME = containersHost; + DB_PORT = toString config.services.postgresql.port; + DB_USERNAME = dbuser; + DB_DATABASE_NAME = dbname; + REDIS_HOSTNAME = containersHost; + REDIS_PORT = toString config.services.redis.servers.immich.port; + VITE_SERVER_ENDPOINT = "https://${domain}/api"; + + # immich requires this value, even though we don't have password auth + DB_PASSWORD = "x"; + }; + # only secrets need to be included, e.g. JWT_SECRET, MAPBOX_KEY + environmentFiles = [ config.age.secrets.immich-env.path ]; + }; +in { + age.secrets.immich-env.file = ../secrets/immich/.env.age; + + services.postgresql = { + enable = true; + ensureDatabases = [ dbname ]; + ensureUsers = [{ + name = dbuser; + ensurePermissions."DATABASE ${dbname}" = "ALL PRIVILEGES"; + }]; + }; + + services.redis.servers.immich.enable = true; + + systemd.services.prepare-immich = { + enable = true; + wantedBy = [ "multi-user.target" ]; + script = '' + mkdir -p ${uploadDir} + ''; + before = [ + "${ociBackend}-immich-server.service" + "${ociBackend}-immich-microservices.service" + "${ociBackend}-immich-machine-learning.service" + "${ociBackend}-immich-web.service" + "${ociBackend}-immich-proxy.service" + ]; + }; + + virtualisation.oci-containers.containers = { + immich-server = immichEnv // { + image = "altran1502/immich-server:release"; + entrypoint = "/bin/sh"; + cmd = [ "./start-server.sh" ]; + volumes = [ "${uploadDir}:/usr/src/app/upload" ]; + }; + + immich-microservices = immichEnv // { + image = "altran1502/immich-server:release"; + entrypoint = "/bin/sh"; + cmd = [ "./start-microservices.sh" ]; + volumes = [ "${uploadDir}:/usr/src/app/upload" ]; + }; + + immich-machine-learning = immichEnv // { + image = "altran1502/immich-machine-learning:release"; + entrypoint = "/bin/sh"; + cmd = [ "./entrypoint.sh" ]; + volumes = [ "${uploadDir}:/usr/src/app/upload" ]; + }; + + immich-web = immichEnv // { + image = "altran1502/immich-web:release"; + entrypoint = "/bin/sh"; + cmd = [ "./entrypoint.sh" ]; + }; + }; + + systemd.services = { + "${ociBackend}-immich-server" = { + requires = [ "postgresql.service" "redis-immich.service" ]; + after = [ "postgresql.service" "redis-immich.service" ]; + }; + + "${ociBackend}-immich-microservices" = { + requires = [ "postgresql.service" "redis-immich.service" ]; + after = [ "postgresql.service" "redis-immich.service" ]; + }; + + "${ociBackend}-immich-machine-learning" = { + requires = [ "postgresql.service" ]; + after = [ "postgresql.service" ]; + }; + }; + + services.nginx.virtualHosts.${domain} = { + enableACME = true; + forceSSL = true; + locations."/api" = { + proxyPass = "http://localhost:3001"; + extraConfig = '' + rewrite /api/(.*) /$1 break; + client_max_body_size 50000M; + ''; + }; + locations."/" = { + proxyPass = "http://localhost:3000"; + extraConfig = '' + client_max_body_size 50000M; + ''; + }; + }; +}