fix: fix immich config
This commit is contained in:
parent
6dc69b59c6
commit
9f05386919
Binary file not shown.
BIN
secrets/immich/db-password.age
Normal file
BIN
secrets/immich/db-password.age
Normal file
Binary file not shown.
|
@ -28,6 +28,7 @@ in {
|
||||||
"paperless.age".publicKeys = [ felschr home-pc home-server ];
|
"paperless.age".publicKeys = [ felschr home-pc home-server ];
|
||||||
"nextcloud/admin.age".publicKeys = [ felschr home-pc home-server ];
|
"nextcloud/admin.age".publicKeys = [ felschr home-pc home-server ];
|
||||||
"immich/.env.age".publicKeys = [ felschr home-pc home-server ];
|
"immich/.env.age".publicKeys = [ felschr home-pc home-server ];
|
||||||
|
"immich/db-password.age".publicKeys = [ felschr home-pc home-server ];
|
||||||
|
|
||||||
# home-server
|
# home-server
|
||||||
"home-server/hostKey.age".publicKeys = [ felschr home-server ];
|
"home-server/hostKey.age".publicKeys = [ felschr home-server ];
|
||||||
|
|
|
@ -1,16 +1,17 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
uploadDir = "/var/lib/immich/upload";
|
dataDir = "/var/lib/immich";
|
||||||
|
uploadDir = "${dataDir}/upload";
|
||||||
dbuser = "immich";
|
dbuser = "immich";
|
||||||
dbname = "immich";
|
dbname = "immich";
|
||||||
|
dbPasswordFile = config.age.secrets.immich-db-password.path;
|
||||||
ociBackend = config.virtualisation.oci-containers.backend;
|
ociBackend = config.virtualisation.oci-containers.backend;
|
||||||
containersHost = if ociBackend == "podman" then
|
containersHost = "localhost";
|
||||||
"host.containers.internal"
|
|
||||||
else
|
|
||||||
"host.docker.internal";
|
|
||||||
domain = "photos.felschr.com";
|
domain = "photos.felschr.com";
|
||||||
|
|
||||||
|
pgSuperUser = config.services.postgresql.superUser;
|
||||||
|
|
||||||
immichEnv = {
|
immichEnv = {
|
||||||
environment = {
|
environment = {
|
||||||
NODE_ENV = "production";
|
NODE_ENV = "production";
|
||||||
|
@ -21,18 +22,17 @@ let
|
||||||
REDIS_HOSTNAME = containersHost;
|
REDIS_HOSTNAME = containersHost;
|
||||||
REDIS_PORT = toString config.services.redis.servers.immich.port;
|
REDIS_PORT = toString config.services.redis.servers.immich.port;
|
||||||
VITE_SERVER_ENDPOINT = "https://${domain}/api";
|
VITE_SERVER_ENDPOINT = "https://${domain}/api";
|
||||||
|
|
||||||
# immich requires this value, even though we don't have password auth
|
|
||||||
DB_PASSWORD = "x";
|
|
||||||
};
|
};
|
||||||
# only secrets need to be included, e.g. JWT_SECRET, MAPBOX_KEY
|
# only secrets need to be included, e.g. DB_PASSWORD, JWT_SECRET, MAPBOX_KEY
|
||||||
environmentFiles = [ config.age.secrets.immich-env.path ];
|
environmentFiles = [ config.age.secrets.immich-env.path ];
|
||||||
};
|
};
|
||||||
in {
|
in {
|
||||||
age.secrets.immich-env.file = ../secrets/immich/.env.age;
|
age.secrets.immich-env.file = ../secrets/immich/.env.age;
|
||||||
|
age.secrets.immich-db-password.file = ../secrets/immich/db-password.age;
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
enableTCPIP = true;
|
||||||
ensureDatabases = [ dbname ];
|
ensureDatabases = [ dbname ];
|
||||||
ensureUsers = [{
|
ensureUsers = [{
|
||||||
name = dbuser;
|
name = dbuser;
|
||||||
|
@ -40,14 +40,16 @@ in {
|
||||||
}];
|
}];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.redis.servers.immich.enable = true;
|
services.redis.servers.immich = {
|
||||||
|
|
||||||
systemd.services.prepare-immich = {
|
|
||||||
enable = true;
|
enable = true;
|
||||||
wantedBy = [ "multi-user.target" ];
|
port = 31640;
|
||||||
script = ''
|
};
|
||||||
mkdir -p ${uploadDir}
|
|
||||||
'';
|
systemd.services.immich-init = {
|
||||||
|
enable = true;
|
||||||
|
description = "Set up paths & database access";
|
||||||
|
requires = [ "postgresql.service" ];
|
||||||
|
after = [ "postgresql.service" ];
|
||||||
before = [
|
before = [
|
||||||
"${ociBackend}-immich-server.service"
|
"${ociBackend}-immich-server.service"
|
||||||
"${ociBackend}-immich-microservices.service"
|
"${ociBackend}-immich-microservices.service"
|
||||||
|
@ -55,14 +57,28 @@ in {
|
||||||
"${ociBackend}-immich-web.service"
|
"${ociBackend}-immich-web.service"
|
||||||
"${ociBackend}-immich-proxy.service"
|
"${ociBackend}-immich-proxy.service"
|
||||||
];
|
];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
LoadCredential = [ "db_password:${dbPasswordFile}" ];
|
||||||
|
};
|
||||||
|
script = ''
|
||||||
|
mkdir -p ${dataDir} ${uploadDir}
|
||||||
|
echo "Set immich postgres user password"
|
||||||
|
db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
|
||||||
|
${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${pkgs.postgresql}/bin/psql postgres \
|
||||||
|
-c "alter user ${dbuser} with password '$db_password'"
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualisation.oci-containers.containers = {
|
virtualisation.oci-containers.containers = {
|
||||||
immich-server = immichEnv // {
|
immich-server = immichEnv // {
|
||||||
image = "altran1502/immich-server:release";
|
image = "altran1502/immich-server:release";
|
||||||
|
ports = [ "3001:3001" ];
|
||||||
entrypoint = "/bin/sh";
|
entrypoint = "/bin/sh";
|
||||||
cmd = [ "./start-server.sh" ];
|
cmd = [ "./start-server.sh" ];
|
||||||
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
||||||
|
extraOptions = [ "--network=host" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
immich-microservices = immichEnv // {
|
immich-microservices = immichEnv // {
|
||||||
|
@ -70,6 +86,7 @@ in {
|
||||||
entrypoint = "/bin/sh";
|
entrypoint = "/bin/sh";
|
||||||
cmd = [ "./start-microservices.sh" ];
|
cmd = [ "./start-microservices.sh" ];
|
||||||
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
||||||
|
extraOptions = [ "--network=host" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
immich-machine-learning = immichEnv // {
|
immich-machine-learning = immichEnv // {
|
||||||
|
@ -77,12 +94,15 @@ in {
|
||||||
entrypoint = "/bin/sh";
|
entrypoint = "/bin/sh";
|
||||||
cmd = [ "./entrypoint.sh" ];
|
cmd = [ "./entrypoint.sh" ];
|
||||||
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
volumes = [ "${uploadDir}:/usr/src/app/upload" ];
|
||||||
|
extraOptions = [ "--network=host" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
immich-web = immichEnv // {
|
immich-web = immichEnv // {
|
||||||
image = "altran1502/immich-web:release";
|
image = "altran1502/immich-web:release";
|
||||||
|
ports = [ "3000:3000" ];
|
||||||
entrypoint = "/bin/sh";
|
entrypoint = "/bin/sh";
|
||||||
cmd = [ "./entrypoint.sh" ];
|
cmd = [ "./entrypoint.sh" ];
|
||||||
|
extraOptions = [ "--network=host" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue