feat: switch to upstreamed influxdb2 provisioning, add kanidm provisioning module

hosts/ward/microvms/grafana.nix

@@ -36,16 +36,11 @@ in {
       group = "influxdb2";
     };
 
-    services.influxdb2.provision.ensureApiTokens = [
-      {
-        name = "grafana servers:telegraf (${config.node.name})";
-        org = "servers";
-        user = "admin";
-        readBuckets = ["telegraf"];
-        writeBuckets = ["telegraf"];
-        tokenFile = nodes.ward-influxdb.config.age.secrets."grafana-influxdb-token-${config.node.name}".path;
-      }
-    ];
+    services.influxdb2.provision.organization.servers.auths."grafana servers:telegraf (${config.node.name})" = {
+      readBuckets = ["telegraf"];
+      writeBuckets = ["telegraf"];
+      tokenFile = nodes.ward-influxdb.config.age.secrets."grafana-influxdb-token-${config.node.name}".path;
+    };
   };
 
   nodes.sentinel = {

hosts/ward/microvms/immich.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  nodes,
+  pkgs,
+  ...
+}: let
+  sentinelCfg = nodes.sentinel.config;
+  immichDomain = "immich.${sentinelCfg.repo.secrets.local.personalDomain}";
+in {
+  meta.wireguard-proxy.sentinel.allowedTCPPorts = [config.services.immich.web_port];
+
+  nodes.sentinel = {
+    networking.providedDomains.immich = immichDomain;
+
+    services.nginx = {
+      upstreams.immich = {
+        servers."${config.meta.wireguard.proxy-sentinel.ipv4}:${toString config.services.immich.settings.bind_port}" = {};
+        extraConfig = ''
+          zone immich 64k;
+          keepalive 2;
+        '';
+      };
+      virtualHosts.${immichDomain} = {
+        forceSSL = true;
+        useACMEWildcardHost = true;
+        oauth2.enable = true;
+        oauth2.allowedGroups = ["access_immich"];
+        locations."/" = {
+          proxyPass = "http://immich";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+  services.immich = {
+    enable = true;
+  };
+
+  systemd.services.grafana.serviceConfig.RestartSec = "600"; # Retry every 10 minutes
+}

hosts/ward/microvms/influxdb.nix

@@ -82,17 +82,7 @@ in {
         passwordFile = config.age.secrets.influxdb-admin-password.path;
         tokenFile = config.age.secrets.influxdb-admin-token.path;
       };
-      ensureOrganizations = [
-        {
-          name = "servers";
-        }
-      ];
-      ensureBuckets = [
-        {
-          name = "telegraf";
-          org = "servers";
-        }
-      ];
+      organizations.servers.buckets.telegraf = {};
     };
   };