jml/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

even more backups of things

Browse source
This commit is contained in:
Jay Looney 2025-10-28 16:11:45 -05:00
parent b8d125d448
commit 630f9b0074
46 changed files with 1166 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

65
hosts/lithium/services/immich.nix
View file

@ -4,29 +4,47 @@ let
svcDomain = "photos.${homelabDomain}";
photoStorageDir = "/tank/shares/photos";
svcPort = config.services.immich.port;
# https://docs.immich.app/install/config-file/
jsonSettings = {
server.externalDomain = "https://${svcDomain}";
oauth = {
enabled = true;
issuerUrl = "https://"; # TODO: the kanidm url?
clientId = "immich";
clientSecret = config.sops.placeholder."immich/oauth2_client_secret";
scope = "openid email profile";
signingAlgorithm = "ES256";
storageLabelClaim = "email";
buttonText = "Login with Kanidm";
autoLaunch = true;
mobileOverrideEnabled = true;
mobileRedirectUri = "https://${svcDomain}/api/oauth/mobile-redirect/";
};
};
in
{
# NOTE: The following repo contains a highly mature immich setup on nixos.
# https://github.com/xinyangli/nixos-config/blob/a8b5bea68caea573801ccfdb8ceacb7a8f2b0190/machines/agate/services/immich.nix
services.caddy.virtualHosts."${svcDomain}".extraConfig = ''
reverse_proxy :${svcPort}
reverse_proxy :${toString svcPort}
'';
# NOTE: Primarily to contain DB_PASSWORD to make it possible to backup and restore the DB.
sops.secrets.immich_env = {
sopsFile = ../../secrets/immich.env;
format = "dotenv";
# sops.secrets.immich_env = {
# sopsFile = ../../secrets/immich.env;
# format = "dotenv";
# mode = "0440";
# owner = "immich";
# group = "immich";
# restartUnits = [ "immich.service" ];
# };
sops.secrets."immich/oauth2_client_secret" = { };
sops.templates."immich.json" = {
mode = "0440";
owner = "immich";
group = "immich";
restartUnits = [ "immich.service" ];
};
sops.secrets."immich/oauth2_client_secret" = {
owner = "immich";
group = "kanidm";
mode = "0440";
restartUnits = [ "immich.service" "kanidm.service" ];
owner = config.services.immich.user;
group = config.services.immich.group;
content = builtins.toJSON jsonSettings;
};
users.users.immich = {
@ -45,27 +63,12 @@ in
enable = true;
openFirewall = true;
port = 2283; # default
secretsFile = config.sops.secrets."immich_secrets.env".path;
#secretsFile = config.sops.secrets.immich_env.path;
# TODO: Build this directory with permissions for the immich user.
mediaLocation = "/tank/shares/photos";
# https://docs.immich.app/install/config-file/
settings = {
# TODO: Setup OAuth with Kanidm
oauth = {
enabled = true;
issuerUrl = "https://"; # TODO: the kanidm url?
clientId = "immich";
clientSecret = config.sops.placeholder."immich/oauth2_client_secret";
scope = "openid email profile";
signingAlgorithm = "ES256";
storageLabelClaim = "email";
buttonText = "Login with Kanidm";
autoLaunch = true;
mobileOverrideEnabled = true;
mobileRedirectUri = "https://${svcDomain}/api/oauth/mobile-redirect/";
};
environment = {
IMMICH_CONFIG_FILE = config.sops.templates."immich.json".path;
};
};