diff --git a/.sops.yaml b/.sops.yaml index 9e590d1..2a59089 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -7,6 +7,7 @@ keys: # microvms - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c + - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z creation_rules: - path_regex: hosts/toaster/[^/]+\.yaml$ key_groups: @@ -38,3 +39,9 @@ creation_rules: - *admin_oxa age: - *radicale + - path_regex: hosts/immich/[^/]+\.yaml$ + key_groups: + - pgp: + - *admin_oxa + age: + - *immich diff --git a/flake.nix b/flake.nix index 44869f9..805f1e1 100644 --- a/flake.nix +++ b/flake.nix @@ -129,6 +129,19 @@ ]; }; + immich = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/immich + ./modules/server + ./modules/wg + ]; + }; + radicale = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; }; diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index d727f06..438e47c 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -3,6 +3,7 @@ imports = [ ./auth.nix ./dav.nix + ./immich.nix ]; networking.firewall.allowedTCPPorts = [ diff --git a/hosts/cloud/proxy/immich.nix b/hosts/cloud/proxy/immich.nix new file mode 100644 index 0000000..93e62d2 --- /dev/null +++ b/hosts/cloud/proxy/immich.nix @@ -0,0 +1,33 @@ +{ ... }: +{ + services.nginx.upstreams.immich = { + servers = { + "10.89.88.13:2283" = { }; + "[fd31:185d:722f::13]:2283" = { }; + }; + }; + + services.nginx.virtualHosts."immich.oxapentane.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://immich"; + extraConfig = '' + client_max_body_size 50000M; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; +} diff --git a/hosts/immich/default.nix b/hosts/immich/default.nix new file mode 100644 index 0000000..5c3db21 --- /dev/null +++ b/hosts/immich/default.nix @@ -0,0 +1,78 @@ + +{ config, lib, ... }: +let + mac = "02:00:00:00:00:03"; +in +{ + imports = [ + ./immich.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "qemu"; + mem = 4 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-immich"; + mac = mac; + } + ]; + shares = + [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.13/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "immich"; + system.stateVersion = "24.11"; +} diff --git a/hosts/immich/immich.nix b/hosts/immich/immich.nix new file mode 100644 index 0000000..aa220bf --- /dev/null +++ b/hosts/immich/immich.nix @@ -0,0 +1,19 @@ +{ config, ... }: +{ + sops.secrets."immich.yaml" = { + sopsFile = ./immich.yaml; + owner = config.services.immich.user; + key = ""; + }; + + services.immich = { + enable = true; + host = "10.89.88.13"; + redis.enable = true; + database.createDB = true; + settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815 + environment = { + IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path; + }; + }; +} diff --git a/hosts/immich/immich.yaml b/hosts/immich/immich.yaml new file mode 100644 index 0000000..54075df --- /dev/null +++ b/hosts/immich/immich.yaml @@ -0,0 +1,49 @@ +server: + externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str] +oauth: + enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool] + autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool] + autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool] + clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str] + clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str] + issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS + aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT + cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ + Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9 + 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-24T20:10:57Z" + mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str] + pgp: + - created_at: "2025-01-24T20:02:34Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb + UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1 + c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF + 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx + tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7 + 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K + fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ + 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC + /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U + 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb + pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS + XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX + ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU= + =sCmm + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/hosts/immich/secrets.yaml b/hosts/immich/secrets.yaml new file mode 100644 index 0000000..5639aa7 --- /dev/null +++ b/hosts/immich/secrets.yaml @@ -0,0 +1,42 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiU3BSLzg3c2FMMjlnNDgw + RktIM1FyakRzNURLdHpYcmNudW9BT0JlQmpjCjg2WEE1SFBxWlQzeTdmOGZhSGwr + cHRaT0FJcnN6TTJtYXFEeFM0RlNRNVkKLS0tIGoyKzRhdDRPRlBJZzJ0M2IwdGZN + eUVaVTdsMHJRRVA4WjNCTjYySlo3UlUKFph90mF2p5fclE8AuYvWbDrWXLIJO5gL + tI6pCM+fmY4WQoDTIAfSyXOSF0x29JYPfnIFCtnmYM/0ILzSDyWpGw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-21T17:43:24Z" + mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str] + pgp: + - created_at: "2025-01-21T17:42:17Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ/8Df3Q3j5ibjLMxw+n4qekGsL9Mc1o+T36GS8rTsSh8AYw + J+Ezh/D/q27lnqMxf5l81yeni6bFDPcDiVw3lquhvAm+8xmsM8NAh+HCGYkLN4y4 + Ce3eHKAlR4q9ygfXggvbdddKLGz2PPmKgBJhSyaKVhcCGQMAsCrJOT2j9WgjcJg/ + vkaaKVViFmlszwhoF7x/tgK6Pgrb3LDMcoeMu4vrLKqth2VrHpsGZ2WQ0YaS/njB + A83bAefTkoaY2g3INDo5RPs5Dv4kwOVg7Qyl6+8TD0FWs/T1lObjWS0Z2OfOoMX5 + R9k+BZmj2WObx/+yRe+pqsRMWqiE89ABjDdoP+0md1q4UTly78P1gQi6OZ0EpIaI + Gw4QnZxCvWX/e1iJ47xMCq7Qpa+jmljGjQ2b6Vf3WmkEZLUdKnj5aUppRxLYrTgS + 7eYNySEOXUBfI9CIwlP8qMM8XC63gJ8LqP8H6bHoqo1yHiDBET8FBMHZfxOxQUcM + mCmrUIj+k1C4Q/6z2GkC9LcZqbQ6NTDeGbWbQslVGX9FFjGtlGQ21v3eOU9yT0I2 + RCpIhCjdQuxTdAVoawrMpURmUr5mdpSavjHc1PnWTldC0ugzJAXeOHh7l5vZI6Wh + R4vPUOxz+nHyGCeb3pETf0S2X/P7Lp97y7v2r2Jtn8L7EPkSt0sJQDpLoSW0JcPS + XgHdusbP/tkBfkzkyybGkvUxiLSxUbn5HoRAC71P505snUOq2FivpNNUQLS6Un+B + FMHHfMmE/yymeXMsbcKHPfE9D3NdChPZM9EysmqubxPVAHRxZmpdYudne4Qn90o= + =rEC+ + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.3 diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix index 0437cdf..437f873 100644 --- a/hosts/minime/uvm.nix +++ b/hosts/minime/uvm.nix @@ -1,6 +1,11 @@ { inputs, ... }: { microvm.stateDir = "/var/lib/microvms"; + microvm.autostart = [ + "auth" + "radicale" + "immich" + ]; microvm.vms = { auth = { flake = inputs.self; @@ -10,5 +15,9 @@ flake = inputs.self; updateFlake = "github:gshipunov/nix-config/master"; }; + immich = { + flake = inputs.self; + updateFlake = "github:gshipunov/nix-config/master"; + }; }; } diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index 8885269..5dae4c4 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -39,6 +39,14 @@ publicKey = "EIdTwWTqGJv9i2rV+Uu8d/QptGwFAFjHcHp/Hquhr3g="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; + "immich" = { + address = [ + "10.89.88.13/24" + "fd31:185d:722f::13/48" + ]; + publicKey = "NXBlfKx4udjI6C7Dcp1Us7lYnE+L0avnMb1VSLxj42s="; + privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; + }; }; } ];