From 157c303f3860affa533d876f46ccb3a4b39a7c92 Mon Sep 17 00:00:00 2001 From: oddlama Date: Sat, 13 Sep 2025 20:18:54 +0200 Subject: [PATCH] feat: reenable immich with native module, prepare nixos-extra-modules update --- config/default.nix | 2 +- flake.lock | 811 ++++++++++++++++++--- flake.nix | 15 +- {nix => flake}/agenix-rekey.nix | 0 {nix => flake}/devshell.nix | 2 +- {nix => flake}/extra-builtins.nix | 0 flake/globals.nix | 22 + {nix => flake}/hosts.nix | 0 {nix => flake}/installer-configuration.nix | 0 {nix => flake}/iso.nix | 0 {nix => flake}/pkgs.nix | 0 {nix => flake}/rage-decrypt-and-cache.sh | 0 {nix => flake}/storage-box.nix | 0 hosts/kroma/default.nix | 8 +- hosts/sentinel/firezone.nix | 2 +- hosts/sire/default.nix | 6 +- hosts/sire/guests/immich.nix | 288 ++++++++ hosts/sire/secrets/immich/host.pub | 1 + hosts/ward/default.nix | 2 +- hosts/ward/guests/adguardhome.nix | 2 +- hosts/ward/guests/kanidm.nix | 40 +- modules/default.nix | 2 + modules/distributed-config.nix | 2 +- modules/immich.nix | 445 +++++++++++ nix/globals.nix | 55 -- 25 files changed, 1521 insertions(+), 184 deletions(-) rename {nix => flake}/agenix-rekey.nix (100%) rename {nix => flake}/devshell.nix (97%) rename {nix => flake}/extra-builtins.nix (100%) create mode 100644 flake/globals.nix rename {nix => flake}/hosts.nix (100%) rename {nix => flake}/installer-configuration.nix (100%) rename {nix => flake}/iso.nix (100%) rename {nix => flake}/pkgs.nix (100%) rename {nix => flake}/rage-decrypt-and-cache.sh (100%) rename {nix => flake}/storage-box.nix (100%) create mode 100644 hosts/sire/guests/immich.nix create mode 100644 hosts/sire/secrets/immich/host.pub create mode 100644 modules/immich.nix delete mode 100644 nix/globals.nix diff --git a/config/default.nix b/config/default.nix index ac35002..c032c82 100644 --- a/config/default.nix +++ b/config/default.nix @@ -14,7 +14,7 @@ inputs.idmail.nixosModules.default inputs.impermanence.nixosModules.impermanence inputs.nix-topology.nixosModules.default - inputs.nixos-extra-modules.nixosModules.default + (inputs.nixos-extra-modules + "/modules") inputs.nixos-nftables-firewall.nixosModules.default ../modules diff --git a/flake.lock b/flake.lock index d786bb2..09b9639 100644 --- a/flake.lock +++ b/flake.lock @@ -36,12 +36,12 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "dirtyRev": "647162ded97dd656efa95951a76bf694559618a0-dirty", - "dirtyShortRev": "647162d-dirty", - "lastModified": 1757081179, - "narHash": "sha256-ITukwc/nWVjn8bEZ/iBMAhbuwHFnm+zfP+C6UyFiFrA=", - "type": "git", - "url": "file:///home/malte/projects/agenix-rekey" + "lastModified": 1757623193, + "narHash": "sha256-YNhsbylxLfnBczfc1Er2a4CoLwI69dVGS1PM4VSZkXI=", + "owner": "oddlama", + "repo": "agenix-rekey", + "rev": "0ef82239e33e546739e5a6b6c7c8f7bd1be33c52", + "type": "github" }, "original": { "owner": "oddlama", @@ -49,6 +49,21 @@ "type": "github" } }, + "blank": { + "locked": { + "lastModified": 1625557891, + "narHash": "sha256-O8/MWsPBGhhyPoPLHZAuoZiiHo9q6FLlEeIDEXuj6T4=", + "owner": "divnix", + "repo": "blank", + "rev": "5a5d2684073d9f563072ed07c871d577a6c614a8", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "blank", + "type": "github" + } + }, "crane": { "flake": false, "locked": { @@ -98,6 +113,33 @@ "type": "github" } }, + "crane_4": { + "inputs": { + "flake-compat": "flake-compat_9", + "flake-utils": "flake-utils_4", + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "paisano-mdbook-preprocessor", + "nixpkgs" + ], + "rust-overlay": "rust-overlay_4" + }, + "locked": { + "lastModified": 1676162383, + "narHash": "sha256-krUCKdz7ebHlFYm/A7IbKDnj2ZmMMm3yIEQcooqm7+E=", + "owner": "ipetkov", + "repo": "crane", + "rev": "6fb400ec631b22ccdbc7090b38207f7fb5cfb5f2", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -266,6 +308,35 @@ "type": "github" } }, + "devshell_7": { + "inputs": { + "flake-utils": [ + "nixos-extra-modules", + "nixt", + "std", + "flake-utils" + ], + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1682700442, + "narHash": "sha256-qjaAAcCYgp1pBBG7mY9z95ODUBZMtUpf0Qp3Gt/Wha0=", + "owner": "numtide", + "repo": "devshell", + "rev": "fb6673fe9fe4409e3f43ca86968261e970918a83", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "devshell", + "type": "github" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -273,11 +344,11 @@ ] }, "locked": { - "lastModified": 1756733629, - "narHash": "sha256-dwWGlDhcO5SMIvMSTB4mjQ5Pvo2vtxvpIknhVnSz2I8=", + "lastModified": 1757508292, + "narHash": "sha256-7lVWL5bC6xBIMWWDal41LlGAG+9u2zUorqo3QCUL4p4=", "owner": "nix-community", "repo": "disko", - "rev": "a5c4f2ab72e3d1ab43e3e65aa421c6f2bd2e12a1", + "rev": "146f45bee02b8bd88812cfce6ffc0f933788875a", "type": "github" }, "original": { @@ -286,6 +357,38 @@ "type": "github" } }, + "dmerge": { + "inputs": { + "haumea": "haumea", + "namaka": "namaka", + "nixlib": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ], + "yants": [ + "nixos-extra-modules", + "nixt", + "std", + "yants" + ] + }, + "locked": { + "lastModified": 1684178600, + "narHash": "sha256-EtSQcCHRQUBBEj4vbYU0vgPUYiKP261ero5k1QfQ3Bc=", + "owner": "divnix", + "repo": "dmerge", + "rev": "ac9932f26325afac5baa59cf6478432d17762a4e", + "type": "github" + }, + "original": { + "owner": "divnix", + "ref": "0.2.0", + "repo": "dmerge", + "type": "github" + } + }, "dream2nix": { "inputs": { "nixpkgs": [ @@ -359,6 +462,25 @@ "type": "github" } }, + "fenix": { + "inputs": { + "nixpkgs": "nixpkgs", + "rust-analyzer-src": "rust-analyzer-src" + }, + "locked": { + "lastModified": 1677306201, + "narHash": "sha256-VZ9x7qdTosFvVsrpgFHrtYfT6PU3yMIs7NRYn9ELapI=", + "owner": "nix-community", + "repo": "fenix", + "rev": "0923f0c162f65ae40261ec940406049726cfeab4", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "fenix", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -375,6 +497,38 @@ "type": "github" } }, + "flake-compat_10": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_11": { + "flake": false, + "locked": { + "lastModified": 1747046372, + "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-compat_2": { "flake": false, "locked": { @@ -474,11 +628,11 @@ "flake-compat_8": { "flake": false, "locked": { - "lastModified": 1696426674, - "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "lastModified": 1673956053, + "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=", "owner": "edolstra", "repo": "flake-compat", - "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9", "type": "github" }, "original": { @@ -490,11 +644,11 @@ "flake-compat_9": { "flake": false, "locked": { - "lastModified": 1747046372, - "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "lastModified": 1673956053, + "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=", "owner": "edolstra", "repo": "flake-compat", - "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9", "type": "github" }, "original": { @@ -600,6 +754,24 @@ } }, "flake-parts_6": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_4" + }, + "locked": { + "lastModified": 1738453229, + "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_7": { "inputs": { "nixpkgs-lib": [ "nixvim", @@ -607,11 +779,11 @@ ] }, "locked": { - "lastModified": 1754487366, - "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=", + "lastModified": 1756770412, + "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18", + "rev": "4524271976b625a4a605beefd893f270620fd751", "type": "github" }, "original": { @@ -657,15 +829,12 @@ } }, "flake-utils_3": { - "inputs": { - "systems": "systems_4" - }, "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "lastModified": 1659877975, + "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=", "owner": "numtide", "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0", "type": "github" }, "original": { @@ -675,8 +844,23 @@ } }, "flake-utils_4": { + "locked": { + "lastModified": 1667395993, + "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_5": { "inputs": { - "systems": "systems_5" + "systems": "systems_4" }, "locked": { "lastModified": 1731533236, @@ -845,6 +1029,30 @@ "type": "github" } }, + "haumea": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "dmerge", + "nixlib" + ] + }, + "locked": { + "lastModified": 1681176209, + "narHash": "sha256-bJLDun6esIyWtwRVXcsgzGbh4UKu8wJDrPgykqPyzmg=", + "owner": "nix-community", + "repo": "haumea", + "rev": "b915b66b27da3a595d77b139e945bb0a2fcac926", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "haumea", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -852,11 +1060,11 @@ ] }, "locked": { - "lastModified": 1757075491, - "narHash": "sha256-a+NMGl5tcvm+hyfSG2DlVPa8nZLpsumuRj1FfcKb2mQ=", + "lastModified": 1757698511, + "narHash": "sha256-UqHHGydF/q3jfYXCpvYLA0TWtvByOp1NwOKCUjhYmPs=", "owner": "nix-community", "repo": "home-manager", - "rev": "f56bf065f9abedc7bc15e1f2454aa5c8edabaacf", + "rev": "a3fcc92180c7462082cd849498369591dfb20855", "type": "github" }, "original": { @@ -905,6 +1113,29 @@ "type": "github" } }, + "incl": { + "inputs": { + "nixlib": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1669263024, + "narHash": "sha256-E/+23NKtxAqYG/0ydYgxlgarKnxmDbg6rCMWnOBqn9Q=", + "owner": "divnix", + "repo": "incl", + "rev": "ce7bebaee048e4cd7ebdb4cee7885e00c4e2abca", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "incl", + "type": "github" + } + }, "ixx": { "inputs": { "flake-utils": [ @@ -958,19 +1189,6 @@ "type": "github" } }, - "lib-net": { - "flake": false, - "locked": { - "lastModified": 1596309860, - "narHash": "sha256-izAzepR/6cDvnRfaa2ceSolMLMwqzQB5x9q62aR5J2g=", - "type": "tarball", - "url": "https://gist.github.com/duairc/5c9bb3c922e5d501a1edb9e7b3b845ba/archive/3885f7cd9ed0a746a9d675da6f265d41e9fd6704.tar.gz" - }, - "original": { - "type": "tarball", - "url": "https://gist.github.com/duairc/5c9bb3c922e5d501a1edb9e7b3b845ba/archive/3885f7cd9ed0a746a9d675da6f265d41e9fd6704.tar.gz" - } - }, "microvm": { "inputs": { "flake-utils": "flake-utils", @@ -980,11 +1198,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1756913421, - "narHash": "sha256-bApi+D4wQJe4tG03VySlb4lJOBWqpl8DK8niSfKT87U=", + "lastModified": 1757518086, + "narHash": "sha256-qUJFqN9KGhh2nh4ksaFGfGNIuL7p+8PstjtODLbWuSk=", "owner": "astro", "repo": "microvm.nix", - "rev": "2ba6697616834ff8c58ebc6180e4833c6d781b82", + "rev": "f6e7494efa2b17deb2a69a45932d34dc205bd3bb", "type": "github" }, "original": { @@ -1025,6 +1243,67 @@ "type": "github" } }, + "n2c": { + "inputs": { + "flake-utils": [ + "nixos-extra-modules", + "nixt", + "std", + "flake-utils" + ], + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1677330646, + "narHash": "sha256-hUYCwJneMjnxTvj30Fjow6UMJUITqHlpUGpXMPXUJsU=", + "owner": "nlewo", + "repo": "nix2container", + "rev": "ebca8f58d450cae1a19c07701a5a8ae40afc9efc", + "type": "github" + }, + "original": { + "owner": "nlewo", + "repo": "nix2container", + "type": "github" + } + }, + "namaka": { + "inputs": { + "haumea": [ + "nixos-extra-modules", + "nixt", + "std", + "dmerge", + "haumea" + ], + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "dmerge", + "nixlib" + ] + }, + "locked": { + "lastModified": 1683059428, + "narHash": "sha256-ZTMqleCWmuNWhZE375gtF1j1JRkaKEUFN1AM43e7h4Y=", + "owner": "nix-community", + "repo": "namaka", + "rev": "2deba2f416454aec770bc1cc7365e39c73e6b1d7", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.1.1", + "repo": "namaka", + "type": "github" + } + }, "nci": { "inputs": { "crane": "crane", @@ -1086,11 +1365,11 @@ ] }, "locked": { - "lastModified": 1756612744, - "narHash": "sha256-/glV6VAq8Va3ghIbmhET3S1dzkbZqicsk5h+FtvwiPE=", + "lastModified": 1757218147, + "narHash": "sha256-IwOwN70HvoBNB2ckaROxcaCvj5NudNc52taPsv5wtLk=", "owner": "Mic92", "repo": "nix-index-database", - "rev": "3fe768e1f058961095b4a0d7a2ba15dc9736bdc6", + "rev": "9b144dc3ef6e42b888c4190e02746aab13b0e97f", "type": "github" }, "original": { @@ -1122,6 +1401,41 @@ "type": "github" } }, + "nixago": { + "inputs": { + "flake-utils": [ + "nixos-extra-modules", + "nixt", + "std", + "flake-utils" + ], + "nixago-exts": [ + "nixos-extra-modules", + "nixt", + "std", + "blank" + ], + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1683210100, + "narHash": "sha256-bhGDOlkWtlhVECpoOog4fWiFJmLCpVEg09a40aTjCbw=", + "owner": "nix-community", + "repo": "nixago", + "rev": "1da60ad9412135f9ed7a004669fdcf3d378ec630", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixago", + "type": "github" + } + }, "nixlib": { "locked": { "lastModified": 1736643958, @@ -1140,19 +1454,19 @@ "nixos-extra-modules": { "inputs": { "devshell": "devshell_6", - "flake-utils": "flake-utils_3", - "lib-net": "lib-net", + "flake-parts": "flake-parts_6", "nixpkgs": [ "nixpkgs" ], + "nixt": "nixt", "pre-commit-hooks": "pre-commit-hooks_5" }, "locked": { - "lastModified": 1738095226, - "narHash": "sha256-JprmheIKPIs1iqvGpISJEW0v/19yyUxpLOqqBH5RM3g=", + "lastModified": 1745053097, + "narHash": "sha256-BEW57utyWCqP4U+MzCXFqbvEC8LE3iZv5dsPMrmTJ9Q=", "owner": "oddlama", "repo": "nixos-extra-modules", - "rev": "86bb6fb118c59bcda460815c33932bc3d18c1430", + "rev": "7565d8554b0fc9d621851150e7939d34a3a8cd6c", "type": "github" }, "original": { @@ -1184,11 +1498,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1756925795, - "narHash": "sha256-kUb5hehaikfUvoJDEc7ngiieX88TwWX/bBRX9Ar6Tac=", + "lastModified": 1757775351, + "narHash": "sha256-xWsxmNHwt9jV/yFJqzsNeilpH4BR8MPe44Yt0eaGAIM=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "ba6fab29768007e9f2657014a6e134637100c57d", + "rev": "f89c620d3d6e584d98280b48f0af7be4f8506ab5", "type": "github" }, "original": { @@ -1220,15 +1534,15 @@ }, "nixpkgs": { "locked": { - "lastModified": 1756787288, - "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=", - "owner": "NixOS", + "lastModified": 1677063315, + "narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=", + "owner": "nixos", "repo": "nixpkgs", - "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1", + "rev": "988cc958c57ce4350ec248d2d53087777f9e1949", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "nixos", "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" @@ -1273,6 +1587,18 @@ "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz" } }, + "nixpkgs-lib_4": { + "locked": { + "lastModified": 1738452942, + "narHash": "sha256-vJzFZGaCpnmo7I6i416HaBLpC+hvcURh/BQwROcGIp8=", + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz" + } + }, "nixpkgs-stable": { "locked": { "lastModified": 1730741070, @@ -1289,21 +1615,61 @@ "type": "github" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1757487488, + "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixt": { + "inputs": { + "flake-compat": "flake-compat_8", + "nixpkgs": [ + "nixos-extra-modules", + "nixpkgs" + ], + "std": "std", + "std-data-collection": "std-data-collection" + }, + "locked": { + "lastModified": 1729273076, + "narHash": "sha256-h2Y+5bikSXS8MPYpxyZpd+VX9H5uuCS/csMMxZCoS3c=", + "owner": "nix-community", + "repo": "nixt", + "rev": "ad8863c9f9e5a166d663f2f1f0eef74ab913a883", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixt", + "type": "github" + } + }, "nixvim": { "inputs": { - "flake-parts": "flake-parts_6", + "flake-parts": "flake-parts_7", "nixpkgs": [ "nixpkgs" ], "nuschtosSearch": "nuschtosSearch", - "systems": "systems_6" + "systems": "systems_5" }, "locked": { - "lastModified": 1756946299, - "narHash": "sha256-N4PjGA0rittpNZGscKPel+mr/dMcKF73j0yr4rbG3T0=", + "lastModified": 1757619215, + "narHash": "sha256-AAg3S94zMF4BtByF2k9/K/tbC0awNHCc50GxCjccUhw=", "owner": "nix-community", "repo": "nixvim", - "rev": "63496f00c681b3e200bd17878a43ec68b7139a66", + "rev": "43c6f7293eba3fa5ff699e339e55270305e51cab", "type": "github" }, "original": { @@ -1312,9 +1678,24 @@ "type": "github" } }, + "nosys": { + "locked": { + "lastModified": 1668010795, + "narHash": "sha256-JBDVBnos8g0toU7EhIIqQ1If5m/nyBqtHhL3sicdPwI=", + "owner": "divnix", + "repo": "nosys", + "rev": "feade0141487801c71ff55623b421ed535dbdefa", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "nosys", + "type": "github" + } + }, "nuschtosSearch": { "inputs": { - "flake-utils": "flake-utils_4", + "flake-utils": "flake-utils_5", "ixx": "ixx", "nixpkgs": [ "nixvim", @@ -1322,11 +1703,11 @@ ] }, "locked": { - "lastModified": 1755555503, - "narHash": "sha256-WiOO7GUOsJ4/DoMy2IC5InnqRDSo2U11la48vCCIjjY=", + "lastModified": 1756738487, + "narHash": "sha256-8QX7Ab5CcICp7zktL47VQVS+QeaU4YDNAjzty7l7TQE=", "owner": "NuschtOS", "repo": "search", - "rev": "6f3efef888b92e6520f10eae15b86ff537e1d2ea", + "rev": "5feeaeefb571e6ca2700888b944f436f7c05149b", "type": "github" }, "original": { @@ -1335,6 +1716,120 @@ "type": "github" } }, + "paisano": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ], + "nosys": "nosys", + "yants": [ + "nixos-extra-modules", + "nixt", + "std", + "yants" + ] + }, + "locked": { + "lastModified": 1678949904, + "narHash": "sha256-oAoF66hYYz1RPh3lEwb9/4e4iyBAfTbQKZRRQ8gP0Ds=", + "owner": "paisano-nix", + "repo": "core", + "rev": "88f2aff10a5064551d1d4cb86800d17084489ce3", + "type": "github" + }, + "original": { + "owner": "paisano-nix", + "repo": "core", + "type": "github" + } + }, + "paisano-actions": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "paisano-mdbook-preprocessor", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1677306424, + "narHash": "sha256-H9/dI2rGEbKo4KEisqbRPHFG2ajF8Tm111NPdKGIf28=", + "owner": "paisano-nix", + "repo": "actions", + "rev": "65ec4e080b3480167fc1a748c89a05901eea9a9b", + "type": "github" + }, + "original": { + "owner": "paisano-nix", + "repo": "actions", + "type": "github" + } + }, + "paisano-mdbook-preprocessor": { + "inputs": { + "crane": "crane_4", + "fenix": "fenix", + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ], + "paisano-actions": "paisano-actions", + "std": [ + "nixos-extra-modules", + "nixt", + "std" + ] + }, + "locked": { + "lastModified": 1680654400, + "narHash": "sha256-Qdpio+ldhUK3zfl22Mhf8HUULdUOJXDWDdO7MIK69OU=", + "owner": "paisano-nix", + "repo": "mdbook-paisano-preprocessor", + "rev": "11a8fc47f574f194a7ae7b8b98001f6143ba4cf1", + "type": "github" + }, + "original": { + "owner": "paisano-nix", + "repo": "mdbook-paisano-preprocessor", + "type": "github" + } + }, + "paisano-tui": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "blank" + ], + "std": [ + "nixos-extra-modules", + "nixt", + "std" + ] + }, + "locked": { + "lastModified": 1681847764, + "narHash": "sha256-mdd7PJW1BZvxy0cIKsPfAO+ohVl/V7heE5ZTAHzTdv8=", + "owner": "paisano-nix", + "repo": "tui", + "rev": "3096bad91cae73ab8ab3367d31f8a143d248a244", + "type": "github" + }, + "original": { + "owner": "paisano-nix", + "ref": "0.1.1", + "repo": "tui", + "type": "github" + } + }, "parts": { "inputs": { "nixpkgs-lib": [ @@ -1504,7 +1999,7 @@ }, "pre-commit-hooks_5": { "inputs": { - "flake-compat": "flake-compat_8", + "flake-compat": "flake-compat_10", "gitignore": "gitignore_6", "nixpkgs": [ "nixos-extra-modules", @@ -1527,18 +2022,18 @@ }, "pre-commit-hooks_6": { "inputs": { - "flake-compat": "flake-compat_9", + "flake-compat": "flake-compat_11", "gitignore": "gitignore_7", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1755960406, - "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=", + "lastModified": 1757588530, + "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2", + "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411", "type": "github" }, "original": { @@ -1650,12 +2145,29 @@ "nixos-generators": "nixos-generators", "nixos-hardware": "nixos-hardware", "nixos-nftables-firewall": "nixos-nftables-firewall", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_2", "nixvim": "nixvim", "pre-commit-hooks": "pre-commit-hooks_6", "treefmt-nix": "treefmt-nix_4" } }, + "rust-analyzer-src": { + "flake": false, + "locked": { + "lastModified": 1677221702, + "narHash": "sha256-1M+58rC4eTCWNmmX0hQVZP20t3tfYNunl9D/PrGUyGE=", + "owner": "rust-lang", + "repo": "rust-analyzer", + "rev": "f5401f620699b26ed9d47a1d2e838143a18dbe3b", + "type": "github" + }, + "original": { + "owner": "rust-lang", + "ref": "nightly", + "repo": "rust-analyzer", + "type": "github" + } + }, "rust-overlay": { "inputs": { "nixpkgs": [ @@ -1721,6 +2233,39 @@ "type": "github" } }, + "rust-overlay_4": { + "inputs": { + "flake-utils": [ + "nixos-extra-modules", + "nixt", + "std", + "paisano-mdbook-preprocessor", + "crane", + "flake-utils" + ], + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "paisano-mdbook-preprocessor", + "crane", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1675391458, + "narHash": "sha256-ukDKZw922BnK5ohL9LhwtaDAdCsJL7L6ScNEyF1lO9w=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "383a4acfd11d778d5c2efcf28376cbd845eeaedf", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "slimlock": { "inputs": { "nixpkgs": [ @@ -1785,6 +2330,84 @@ "url": "https://spectrum-os.org/git/spectrum" } }, + "std": { + "inputs": { + "arion": [ + "nixos-extra-modules", + "nixt", + "std", + "blank" + ], + "blank": "blank", + "devshell": "devshell_7", + "dmerge": "dmerge", + "flake-utils": "flake-utils_3", + "incl": "incl", + "makes": [ + "nixos-extra-modules", + "nixt", + "std", + "blank" + ], + "microvm": [ + "nixos-extra-modules", + "nixt", + "std", + "blank" + ], + "n2c": "n2c", + "nixago": "nixago", + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "nixpkgs" + ], + "paisano": "paisano", + "paisano-mdbook-preprocessor": "paisano-mdbook-preprocessor", + "paisano-tui": "paisano-tui", + "yants": "yants" + }, + "locked": { + "lastModified": 1684180498, + "narHash": "sha256-kA58ms4yunOVPhe3r7V0IIKeWUV+vl4r2GTcfFfYW5o=", + "owner": "divnix", + "repo": "std", + "rev": "45b431ae09df98e046bcc8271aa209bdfc87444d", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "std", + "type": "github" + } + }, + "std-data-collection": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "nixpkgs" + ], + "std": [ + "nixos-extra-modules", + "nixt", + "std" + ] + }, + "locked": { + "lastModified": 1676163535, + "narHash": "sha256-xofkWLBqU4zj5vzJhWor2Z9CyPGKt7UGkTchsCT48Po=", + "owner": "divnix", + "repo": "std-data-collection", + "rev": "f713d81a6197e1b0854fb201cc7acde5ef9e93d4", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "std-data-collection", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -1860,21 +2483,6 @@ "type": "github" } }, - "systems_6": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, "treefmt": { "inputs": { "nixpkgs": [ @@ -2001,6 +2609,29 @@ "repo": "treefmt-nix", "type": "github" } + }, + "yants": { + "inputs": { + "nixpkgs": [ + "nixos-extra-modules", + "nixt", + "std", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1667096281, + "narHash": "sha256-wRRec6ze0gJHmGn6m57/zhz/Kdvp9HS4Nl5fkQ+uIuA=", + "owner": "divnix", + "repo": "yants", + "rev": "d18f356ec25cb94dc9c275870c3a7927a10f8c3c", + "type": "github" + }, + "original": { + "owner": "divnix", + "repo": "yants", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 8226d52..4f1e1d7 100644 --- a/flake.nix +++ b/flake.nix @@ -104,14 +104,15 @@ inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } { imports = [ - ./nix/agenix-rekey.nix - ./nix/devshell.nix - ./nix/globals.nix - ./nix/hosts.nix - ./nix/iso.nix - ./nix/pkgs.nix - ./nix/storage-box.nix + ./flake/agenix-rekey.nix + ./flake/devshell.nix + ./flake/globals.nix + ./flake/hosts.nix + ./flake/iso.nix + ./flake/pkgs.nix + ./flake/storage-box.nix ./topology/flake-module.nix + (inputs.nixos-extra-modules + "/flake-modules/globals.nix") ]; systems = [ diff --git a/nix/agenix-rekey.nix b/flake/agenix-rekey.nix similarity index 100% rename from nix/agenix-rekey.nix rename to flake/agenix-rekey.nix diff --git a/nix/devshell.nix b/flake/devshell.nix similarity index 97% rename from nix/devshell.nix rename to flake/devshell.nix index 9f5ca78..cc998fa 100644 --- a/nix/devshell.nix +++ b/flake/devshell.nix @@ -81,7 +81,7 @@ name = "NIX_CONFIG"; value = '' plugin-files = ${pkgs.nix-plugins}/lib/nix/plugins - extra-builtins-file = ${./..}/nix/extra-builtins.nix + extra-builtins-file = ${./..}/flake/extra-builtins.nix ''; } ]; diff --git a/nix/extra-builtins.nix b/flake/extra-builtins.nix similarity index 100% rename from nix/extra-builtins.nix rename to flake/extra-builtins.nix diff --git a/flake/globals.nix b/flake/globals.nix new file mode 100644 index 0000000..96eaf22 --- /dev/null +++ b/flake/globals.nix @@ -0,0 +1,22 @@ +{ + globals = { + optModules = [ + ../modules/globals.nix + ]; + defModules = [ + ../globals.nix + ]; + attrkeys = [ + "domains" + "hetzner" + "kanidm" + "macs" + "mail" + "monitoring" + "myuser" + "net" + "root" + "services" + ]; + }; +} diff --git a/nix/hosts.nix b/flake/hosts.nix similarity index 100% rename from nix/hosts.nix rename to flake/hosts.nix diff --git a/nix/installer-configuration.nix b/flake/installer-configuration.nix similarity index 100% rename from nix/installer-configuration.nix rename to flake/installer-configuration.nix diff --git a/nix/iso.nix b/flake/iso.nix similarity index 100% rename from nix/iso.nix rename to flake/iso.nix diff --git a/nix/pkgs.nix b/flake/pkgs.nix similarity index 100% rename from nix/pkgs.nix rename to flake/pkgs.nix diff --git a/nix/rage-decrypt-and-cache.sh b/flake/rage-decrypt-and-cache.sh similarity index 100% rename from nix/rage-decrypt-and-cache.sh rename to flake/rage-decrypt-and-cache.sh diff --git a/nix/storage-box.nix b/flake/storage-box.nix similarity index 100% rename from nix/storage-box.nix rename to flake/storage-box.nix diff --git a/hosts/kroma/default.nix b/hosts/kroma/default.nix index ab67ee8..da8e2f8 100644 --- a/hosts/kroma/default.nix +++ b/hosts/kroma/default.nix @@ -42,7 +42,13 @@ "usb_storage" "sd_mod" ]; - boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; + boot.binfmt.emulatedSystems = [ + "aarch64-linux" + "i686-linux" + "x86_64-windows" + "riscv32-linux" + "riscv64-linux" + ]; } // lib.optionalAttrs (!minimal) { # TODO goodbye once -sk keys. diff --git a/hosts/sentinel/firezone.nix b/hosts/sentinel/firezone.nix index a90301c..7591cf9 100644 --- a/hosts/sentinel/firezone.nix +++ b/hosts/sentinel/firezone.nix @@ -19,7 +19,7 @@ let "photos.${globals.domains.me}" "s3.photos.${globals.domains.me}" globals.services.mealie.domain - # globals.services.immich.domain + globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain globals.services.paperless.domain diff --git a/hosts/sire/default.nix b/hosts/sire/default.nix index 82103a5..6287694 100644 --- a/hosts/sire/default.nix +++ b/hosts/sire/default.nix @@ -145,9 +145,9 @@ // mkMicrovm "paperless" { enablePaperlessDataset = true; } - # // mkMicrovm "immich" { - # enableStorageDataset = true; - # } + // mkMicrovm "immich" { + enableStorageDataset = true; + } // mkMicrovm "ai" { } // mkMicrovm "minecraft" { } // mkMicrovm "ente" { diff --git a/hosts/sire/guests/immich.nix b/hosts/sire/guests/immich.nix new file mode 100644 index 0000000..c0436f2 --- /dev/null +++ b/hosts/sire/guests/immich.nix @@ -0,0 +1,288 @@ +{ + config, + globals, + lib, + nodes, + ... +}: +let + immichDomain = "immich.${globals.domains.me}"; +in +{ + microvm.mem = 1024 * 12; + microvm.vcpu = 16; + + # Mirror the original oauth2 secret + age.secrets.immich-oauth2-client-secret = { + inherit (nodes.ward-kanidm.config.age.secrets.kanidm-oauth2-immich) rekeyFile; + mode = "440"; + group = "immich"; + }; + + wireguard.proxy-sentinel = { + client.via = "sentinel"; + firewallRuleForNode.sentinel.allowedTCPPorts = [ 2283 ]; + }; + wireguard.proxy-home = { + client.via = "ward"; + firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ 2283 ]; + }; + + globals.services.immich.domain = immichDomain; + globals.monitoring.http.immich = { + url = "https://${immichDomain}"; + expectedBodyRegex = "immutable.entry.app"; + network = "internet"; + }; + + environment.persistence."/persist".directories = [ + { + directory = "/var/cache/immich"; + user = "immich"; + group = "immich"; + mode = "0750"; + } + ]; + + environment.persistence."/storage".directories = [ + { + directory = "/var/lib/immich"; + user = "immich"; + group = "immich"; + mode = "0750"; + } + ]; + + services.immich = { + enable = true; + # We use VectorChord from the beginning + database.enableVectors = false; + environment = { + IMMICH_LOG_LEVEL = "verbose"; + IMMICH_TRUSTED_PROXIES = lib.concatStringsSep "," [ + ]; + }; + settings = { + backup.database = { + cronExpression = "0 02 * * *"; + enabled = true; + keepLastAmount = 14; + }; + ffmpeg = { + accel = "disabled"; + accelDecode = false; + acceptedAudioCodecs = [ + "aac" + "mp3" + "libopus" + "pcm_s16le" + ]; + acceptedContainers = [ + "mov" + "ogg" + "webm" + ]; + acceptedVideoCodecs = [ "h264" ]; + bframes = -1; + cqMode = "auto"; + crf = 23; + gopSize = 0; + maxBitrate = "0"; + preferredHwDevice = "auto"; + preset = "ultrafast"; + refs = 0; + targetAudioCodec = "aac"; + targetResolution = "720"; + targetVideoCodec = "h264"; + temporalAQ = false; + threads = 0; + tonemap = "hable"; + transcode = "required"; + twoPass = false; + }; + image = { + colorspace = "p3"; + extractEmbedded = false; + preview = { + format = "jpeg"; + quality = 80; + size = 1440; + }; + thumbnail = { + format = "webp"; + quality = 80; + size = 250; + }; + }; + job = { + backgroundTask.concurrency = 5; + faceDetection.concurrency = 2; + library.concurrency = 5; + metadataExtraction.concurrency = 5; + migration.concurrency = 5; + notifications.concurrency = 5; + search.concurrency = 5; + sidecar.concurrency = 5; + smartSearch.concurrency = 2; + thumbnailGeneration.concurrency = 3; + videoConversion.concurrency = 1; + }; + library = { + scan = { + cronExpression = "0 0 * * *"; + enabled = true; + }; + watch.enabled = false; + }; + logging = { + enabled = true; + level = "log"; + }; + machineLearning = { + clip = { + enabled = true; + modelName = "ViT-B-32__openai"; + }; + duplicateDetection = { + enabled = true; + maxDistance = 0.01; + }; + enabled = true; + facialRecognition = { + enabled = true; + maxDistance = 0.5; + minFaces = 2; + minScore = 0.65; + modelName = "buffalo_l"; + }; + urls = [ "http://localhost:3003" ]; + }; + map = { + darkStyle = "https://tiles.immich.cloud/v1/style/dark.json"; + enabled = true; + lightStyle = "https://tiles.immich.cloud/v1/style/light.json"; + }; + metadata.faces.import = false; + newVersionCheck.enabled = true; + notifications = { + smtp = { + enabled = false; + from = ""; + replyTo = ""; + transport = { + host = ""; + ignoreCert = false; + password = ""; + port = 587; + username = ""; + }; + }; + }; + oauth = rec { + autoLaunch = false; + autoRegister = true; + buttonText = "Login with Kanidm"; + clientId = "immich"; + clientSecret._secret = config.age.secrets.immich-oauth2-client-secret.path; + defaultStorageQuota = null; + enabled = true; + issuerUrl = "https://${globals.services.kanidm.domain}/oauth2/openid/${clientId}"; + mobileOverrideEnabled = true; + mobileRedirectUri = "https://${immichDomain}/api/oauth/mobile-redirect"; + profileSigningAlgorithm = "none"; + scope = "openid email profile"; + signingAlgorithm = "ES256"; + storageLabelClaim = "preferred_username"; + storageQuotaClaim = "immich_quota"; + }; + passwordLogin.enabled = true; + reverseGeocoding.enabled = true; + server = { + externalDomain = "https://${immichDomain}"; + loginPageMessage = "Besser im Stuhl einschlafen als im Schlaf einstuhlen."; + }; + storageTemplate = { + enabled = true; + hashVerificationEnabled = true; + template = "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}"; + }; + theme.customCss = ""; + trash = { + days = 30; + enabled = true; + }; + user.deleteDelay = 7; + }; + }; + + nodes.sentinel = { + services.nginx = { + upstreams.immich = { + servers."${config.wireguard.proxy-sentinel.ipv4}:2283" = { }; + extraConfig = '' + zone immich 64k; + keepalive 2; + ''; + monitoring = { + enable = true; + expectedBodyRegex = "immutable.entry.app"; + }; + }; + virtualHosts.${immichDomain} = { + forceSSL = true; + useACMEWildcardHost = true; + locations."/" = { + proxyPass = "http://immich"; + proxyWebsockets = true; + }; + extraConfig = '' + client_max_body_size 50G; + proxy_buffering off; + proxy_request_buffering off; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; + }; + + nodes.ward-web-proxy = { + services.nginx = { + upstreams.immich = { + servers."${config.wireguard.proxy-home.ipv4}:2283" = { }; + extraConfig = '' + zone immich 64k; + keepalive 2; + ''; + monitoring = { + enable = true; + expectedBodyRegex = "immutable.entry.app"; + }; + }; + virtualHosts.${immichDomain} = { + forceSSL = true; + useACMEWildcardHost = true; + locations."/" = { + proxyPass = "http://immich"; + proxyWebsockets = true; + extraConfig = ''''; + }; + extraConfig = '' + client_max_body_size 50G; + proxy_buffering off; + proxy_request_buffering off; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + allow ${globals.net.home-lan.vlans.home.cidrv4}; + allow ${globals.net.home-lan.vlans.home.cidrv6}; + # Firezone traffic + allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv4}; + allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv6}; + deny all; + ''; + }; + }; + }; +} diff --git a/hosts/sire/secrets/immich/host.pub b/hosts/sire/secrets/immich/host.pub new file mode 100644 index 0000000..9c7563b --- /dev/null +++ b/hosts/sire/secrets/immich/host.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKE+geXK2RVVNwZVoYOuX7pW+6mbgCa9SIghJCdHmbSB diff --git a/hosts/ward/default.nix b/hosts/ward/default.nix index 3ec2f35..0a08a1f 100644 --- a/hosts/ward/default.nix +++ b/hosts/ward/default.nix @@ -21,7 +21,7 @@ let "photos.${globals.domains.me}" "s3.photos.${globals.domains.me}" globals.services.mealie.domain - # globals.services.immich.domain + globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain globals.services.paperless.domain diff --git a/hosts/ward/guests/adguardhome.nix b/hosts/ward/guests/adguardhome.nix index e26480b..7f2816a 100644 --- a/hosts/ward/guests/adguardhome.nix +++ b/hosts/ward/guests/adguardhome.nix @@ -118,7 +118,7 @@ in "photos.${globals.domains.me}" "s3.photos.${globals.domains.me}" globals.services.mealie.domain - # globals.services.immich.domain + globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain globals.services.paperless.domain diff --git a/hosts/ward/guests/kanidm.nix b/hosts/ward/guests/kanidm.nix index 474d983..b657913 100644 --- a/hosts/ward/guests/kanidm.nix +++ b/hosts/ward/guests/kanidm.nix @@ -37,7 +37,7 @@ in age.secrets.kanidm-oauth2-forgejo = mkRandomSecret; age.secrets.kanidm-oauth2-grafana = mkRandomSecret; - # age.secrets.kanidm-oauth2-immich = mkRandomSecret; + age.secrets.kanidm-oauth2-immich = mkRandomSecret; age.secrets.kanidm-oauth2-firezone = mkRandomSecret; age.secrets.kanidm-oauth2-mealie = mkRandomSecret; age.secrets.kanidm-oauth2-paperless = mkRandomSecret; @@ -115,27 +115,23 @@ in inherit (globals.kanidm) persons; - # # Immich - # groups."immich.access" = { }; - # systems.oauth2.immich = { - # displayName = "Immich"; - # originUrl = [ - # "https://${globals.services.immich.domain}/auth/login" - # "https://${globals.services.immich.domain}/api/oauth/mobile-redirect" - # ]; - # originLanding = "https://${globals.services.immich.domain}/"; - # basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path; - # preferShortUsername = true; - # # XXX: PKCE is currently not supported by immich - # allowInsecureClientDisablePkce = true; - # # XXX: RS256 is used instead of ES256 so additionally we need legacy crypto - # enableLegacyCrypto = true; - # scopeMaps."immich.access" = [ - # "openid" - # "email" - # "profile" - # ]; - # }; + # Immich + groups."immich.access" = { }; + systems.oauth2.immich = { + displayName = "Immich"; + originUrl = [ + "https://${globals.services.immich.domain}/auth/login" + "https://${globals.services.immich.domain}/api/oauth/mobile-redirect" + ]; + originLanding = "https://${globals.services.immich.domain}/"; + basicSecretFile = config.age.secrets.kanidm-oauth2-immich.path; + preferShortUsername = true; + scopeMaps."immich.access" = [ + "openid" + "email" + "profile" + ]; + }; # Firezone groups."firezone.access" = { }; diff --git a/modules/default.nix b/modules/default.nix index d1cac02..3596ac1 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,6 +1,7 @@ { disabledModules = [ "services/web-apps/mealie.nix" + "services/web-apps/immich.nix" ]; imports = [ ./acme-wildcard.nix @@ -10,6 +11,7 @@ ./ente.nix ./globals.nix ./mealie.nix + ./immich.nix ./meta.nix ./nginx-upstream-monitoring.nix ./oauth2-proxy.nix diff --git a/modules/distributed-config.nix b/modules/distributed-config.nix index 3cb0779..8774944 100644 --- a/modules/distributed-config.nix +++ b/modules/distributed-config.nix @@ -88,7 +88,7 @@ let in { options.nodes = mkOption { - description = "Options forwareded to the given node."; + description = "Options forwarded to the given node."; default = { }; type = types.attrsOf ( types.submodule { diff --git a/modules/immich.nix b/modules/immich.nix new file mode 100644 index 0000000..e8a79be --- /dev/null +++ b/modules/immich.nix @@ -0,0 +1,445 @@ +{ + config, + lib, + pkgs, + utils, + ... +}: +let + cfg = config.services.immich; + format = pkgs.formats.json { }; + isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host; + isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host; + + commonServiceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 3; + + # Hardening + CapabilityBoundingSet = ""; + NoNewPrivileges = true; + PrivateUsers = true; + PrivateTmp = true; + PrivateDevices = cfg.accelerationDevices == [ ]; + DeviceAllow = mkIf (cfg.accelerationDevices != null) cfg.accelerationDevices; + PrivateMounts = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + UMask = "0077"; + }; + inherit (lib) + types + mkIf + mkOption + mkEnableOption + ; + + postgresqlPackage = + if cfg.database.enable then config.services.postgresql.package else pkgs.postgresql; +in +{ + options.services.immich = { + enable = mkEnableOption "Immich"; + package = lib.mkPackageOption pkgs "immich" { }; + + mediaLocation = mkOption { + type = types.path; + default = "/var/lib/immich"; + description = "Directory used to store media files. If it is not the default, the directory has to be created manually such that the immich user is able to read and write to it."; + }; + environment = mkOption { + type = types.submodule { freeformType = types.attrsOf types.str; }; + default = { }; + example = { + IMMICH_LOG_LEVEL = "verbose"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options tagged with 'server', 'api' or 'microservices'. + ''; + }; + secretsFile = mkOption { + type = types.nullOr ( + types.str + // { + # We don't want users to be able to pass a path literal here but + # it should look like a path. + check = it: lib.isString it && lib.types.path.check it; + } + ); + default = null; + example = "/run/secrets/immich"; + description = '' + Path of a file with extra environment variables to be loaded from disk. This file is not added to the nix store, so it can be used to pass secrets to immich. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options. + + To set a database password set this to a file containing: + ``` + DB_PASSWORD= + ``` + ''; + }; + host = mkOption { + type = types.str; + default = "localhost"; + description = "The host that immich will listen on."; + }; + port = mkOption { + type = types.port; + default = 2283; + description = "The port that immich will listen on."; + }; + openFirewall = mkOption { + type = types.bool; + default = false; + description = "Whether to open the immich port in the firewall"; + }; + user = mkOption { + type = types.str; + default = "immich"; + description = "The user immich should run as."; + }; + group = mkOption { + type = types.str; + default = "immich"; + description = "The group immich should run as."; + }; + + settings = mkOption { + default = null; + description = '' + Configuration for Immich. + See or navigate to + for + options and defaults. + Setting it to `null` allows configuring Immich in the web interface. + ''; + type = types.nullOr ( + types.submodule { + freeformType = format.type; + options = { + newVersionCheck.enabled = mkOption { + type = types.bool; + default = false; + description = '' + Check for new versions. + This feature relies on periodic communication with github.com. + ''; + }; + server.externalDomain = mkOption { + type = types.str; + default = ""; + description = "Domain for publicly shared links, including `http(s)://`."; + }; + }; + } + ); + }; + + machine-learning = { + enable = + mkEnableOption "immich's machine-learning functionality to detect faces and search for objects" + // { + default = true; + }; + environment = mkOption { + type = types.submodule { freeformType = types.attrsOf types.str; }; + default = { }; + example = { + MACHINE_LEARNING_MODEL_TTL = "600"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options tagged with 'machine-learning'. + ''; + }; + }; + + accelerationDevices = mkOption { + type = types.nullOr (types.listOf types.str); + default = [ ]; + example = [ "/dev/dri/renderD128" ]; + description = '' + A list of device paths to hardware acceleration devices that immich should + have access to. This is useful when transcoding media files. + The special value `[ ]` will disallow all devices using `PrivateDevices`. `null` will give access to all devices. + ''; + }; + + database = { + enable = + mkEnableOption "the postgresql database for use with immich. See {option}`services.postgresql`" + // { + default = true; + }; + enableVectorChord = + mkEnableOption "the new VectorChord extension for full-text search in Postgres" + // { + default = true; + }; + enableVectors = + mkEnableOption "pgvecto.rs in the database. You may disable this, if you have migrated to VectorChord and deleted the `vectors` schema." + // { + default = lib.versionOlder config.system.stateVersion "25.11"; + defaultText = lib.literalExpression "lib.versionOlder config.system.stateVersion \"25.11\""; + }; + createDB = mkEnableOption "the automatic creation of the database for immich." // { + default = true; + }; + name = mkOption { + type = types.str; + default = "immich"; + description = "The name of the immich database."; + }; + host = mkOption { + type = types.str; + default = "/run/postgresql"; + example = "127.0.0.1"; + description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path."; + }; + port = mkOption { + type = types.port; + default = 5432; + description = "Port of the postgresql server."; + }; + user = mkOption { + type = types.str; + default = "immich"; + description = "The database user for immich."; + }; + }; + redis = { + enable = mkEnableOption "a redis cache for use with immich" // { + default = true; + }; + host = mkOption { + type = types.str; + default = config.services.redis.servers.immich.unixSocket; + defaultText = lib.literalExpression "config.services.redis.servers.immich.unixSocket"; + description = "The host that redis will listen on."; + }; + port = mkOption { + type = types.port; + default = 0; + description = "The port that redis will listen on. Set to zero to disable TCP."; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = !isPostgresUnixSocket -> cfg.secretsFile != null; + message = "A secrets file containing at least the database password must be provided when unix sockets are not used."; + } + { + # When removing this assertion, please adjust the nixosTests accordingly. + assertion = + (cfg.database.enable && cfg.database.enableVectors) + -> lib.versionOlder config.services.postgresql.package.version "17"; + message = "Immich doesn't support PostgreSQL 17+ when using pgvecto.rs. Consider disabling it using services.immich.database.enableVectors if it is not needed anymore."; + } + { + assertion = cfg.database.enable -> (cfg.database.enableVectorChord || cfg.database.enableVectors); + message = "At least one of services.immich.database.enableVectorChord and services.immich.database.enableVectors has to be enabled."; + } + ]; + + services.postgresql = mkIf cfg.database.enable { + enable = true; + ensureDatabases = mkIf cfg.database.createDB [ cfg.database.name ]; + ensureUsers = mkIf cfg.database.createDB [ + { + name = cfg.database.user; + ensureDBOwnership = true; + ensureClauses.login = true; + } + ]; + extensions = + ps: + lib.optionals cfg.database.enableVectors [ ps.pgvecto-rs ] + ++ lib.optionals cfg.database.enableVectorChord [ + ps.pgvector + ps.vectorchord + ]; + settings = { + shared_preload_libraries = + lib.optionals cfg.database.enableVectors [ + "vectors.so" + ] + ++ lib.optionals cfg.database.enableVectorChord [ "vchord.so" ]; + search_path = "\"$user\", public, vectors"; + }; + }; + systemd.services.postgresql-setup.serviceConfig.ExecStartPost = + let + extensions = [ + "unaccent" + "uuid-ossp" + "cube" + "earthdistance" + "pg_trgm" + ] + ++ lib.optionals cfg.database.enableVectors [ + "vectors" + ] + ++ lib.optionals cfg.database.enableVectorChord [ + "vector" + "vchord" + ]; + sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" '' + ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions} + + ALTER SCHEMA public OWNER TO ${cfg.database.user}; + ${lib.optionalString cfg.database.enableVectors "ALTER SCHEMA vectors OWNER TO ${cfg.database.user};"} + GRANT SELECT ON TABLE pg_vector_index_stat TO ${cfg.database.user}; + + ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions} + ''; + in + [ + '' + ${lib.getExe' postgresqlPackage "psql"} -d "${cfg.database.name}" -f "${sqlFile}" + '' + ]; + + services.redis.servers = mkIf cfg.redis.enable { + immich = { + enable = true; + inherit (cfg.redis) port; + bind = mkIf (!isRedisUnixSocket) cfg.redis.host; + }; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; + + services.immich.environment = + let + postgresEnv = + if isPostgresUnixSocket then + { DB_URL = "postgresql:///${cfg.database.name}?host=${cfg.database.host}"; } + else + { + DB_HOSTNAME = cfg.database.host; + DB_PORT = toString cfg.database.port; + DB_DATABASE_NAME = cfg.database.name; + DB_USERNAME = cfg.database.user; + }; + redisEnv = + if isRedisUnixSocket then + { REDIS_SOCKET = cfg.redis.host; } + else + { + REDIS_PORT = toString cfg.redis.port; + REDIS_HOSTNAME = cfg.redis.host; + }; + in + postgresEnv + // redisEnv + // { + IMMICH_HOST = cfg.host; + IMMICH_PORT = toString cfg.port; + IMMICH_MEDIA_LOCATION = cfg.mediaLocation; + IMMICH_MACHINE_LEARNING_URL = "http://localhost:3003"; + } + // lib.optionalAttrs (cfg.settings != null) { + IMMICH_CONFIG_FILE = "/run/immich/config.json"; + }; + + services.immich.machine-learning.environment = { + MACHINE_LEARNING_WORKERS = "1"; + MACHINE_LEARNING_WORKER_TIMEOUT = "120"; + MACHINE_LEARNING_CACHE_FOLDER = "/var/cache/immich"; + IMMICH_HOST = "localhost"; + IMMICH_PORT = "3003"; + }; + + systemd.slices.system-immich = { + description = "Immich (self-hosted photo and video backup solution) slice"; + documentation = [ "https://immich.app/docs" ]; + }; + + systemd.services.immich-server = { + description = "Immich backend server (Self-hosted photo and video backup solution)"; + requires = lib.mkIf cfg.database.enable [ "postgresql.target" ]; + after = [ "network.target" ] ++ lib.optionals cfg.database.enable [ "postgresql.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg) environment; + path = [ + # gzip and pg_dumpall are used by the backup service + pkgs.gzip + postgresqlPackage + ]; + + preStart = '' + # Splice secrets into json configuration + ${utils.genJqSecretsReplacementSnippet cfg.settings "/run/immich/config.json"} + ''; + + serviceConfig = commonServiceConfig // { + ExecStart = lib.getExe cfg.package; + EnvironmentFile = mkIf (cfg.secretsFile != null) cfg.secretsFile; + Slice = "system-immich.slice"; + StateDirectory = "immich"; + SyslogIdentifier = "immich"; + RuntimeDirectory = "immich"; + User = cfg.user; + Group = cfg.group; + # ensure that immich-server has permission to connect to the redis socket. + SupplementaryGroups = mkIf (cfg.redis.enable && isRedisUnixSocket) [ + config.services.redis.servers.immich.group + ]; + }; + }; + + systemd.services.immich-machine-learning = mkIf cfg.machine-learning.enable { + description = "immich machine learning"; + requires = lib.mkIf cfg.database.enable [ "postgresql.target" ]; + after = [ "network.target" ] ++ lib.optionals cfg.database.enable [ "postgresql.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg.machine-learning) environment; + serviceConfig = commonServiceConfig // { + ExecStart = lib.getExe (cfg.package.machine-learning.override { immich = cfg.package; }); + Slice = "system-immich.slice"; + CacheDirectory = "immich"; + User = cfg.user; + Group = cfg.group; + }; + }; + + systemd.tmpfiles.settings = { + immich = { + # Redundant to the `UMask` service config setting on new installs, but installs made in + # early 24.11 created world-readable media storage by default, which is a privacy risk. This + # fixes those installs. + "${cfg.mediaLocation}" = { + e = { + inherit (cfg) user; + inherit (cfg) group; + mode = "0700"; + }; + }; + }; + }; + + users.users = mkIf (cfg.user == "immich") { + immich = { + name = "immich"; + inherit (cfg) group; + isSystemUser = true; + }; + }; + users.groups = mkIf (cfg.group == "immich") { immich = { }; }; + }; +} diff --git a/nix/globals.nix b/nix/globals.nix deleted file mode 100644 index 35a85c1..0000000 --- a/nix/globals.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ inputs, ... }: -{ - flake = - { - config, - lib, - ... - }: - { - globals = - let - globalsSystem = lib.evalModules { - prefix = [ "globals" ]; - specialArgs = { - inherit (inputs.self.pkgs.x86_64-linux) lib; - inherit inputs; - inherit (config) nodes; - }; - modules = [ - ../modules/globals.nix - ../globals.nix - ( - { lib, ... }: - { - globals = lib.mkMerge ( - lib.concatLists ( - lib.flip lib.mapAttrsToList config.nodes ( - name: cfg: - builtins.addErrorContext "while aggregating globals from nixosConfigurations.${name} into flake-level globals:" cfg.config._globalsDefs - ) - ) - ); - } - ) - ]; - }; - in - { - # Make sure the keys of this attrset are trivially evaluatable to avoid infinite recursion, - # therefore we inherit relevant attributes from the config. - inherit (globalsSystem.config.globals) - domains - hetzner - kanidm - macs - mail - monitoring - myuser - net - root - services - ; - }; - }; -}