immich: init

.sops.yaml

@@ -7,6 +7,7 @@ keys:
   # microvms
   - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
   - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
+  - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
 creation_rules:
   - path_regex: hosts/toaster/[^/]+\.yaml$
     key_groups:
@@ -38,3 +39,9 @@ creation_rules:
         - *admin_oxa
         age:
         - *radicale
+  - path_regex: hosts/immich/[^/]+\.yaml$
+    key_groups:
+      - pgp:
+        - *admin_oxa
+        age:
+        - *immich

flake.nix

@@ -129,6 +129,19 @@
           ];
         };
 
+        immich = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            sops-nix.nixosModules.sops
+            microvm.nixosModules.microvm
+
+            ./hosts/immich
+            ./modules/server
+            ./modules/wg
+          ];
+        };
+
         radicale = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = { inherit inputs; };

hosts/cloud/proxy/default.nix

@@ -3,6 +3,7 @@
   imports = [
     ./auth.nix
     ./dav.nix
+    ./immich.nix
   ];
 
   networking.firewall.allowedTCPPorts = [

hosts/cloud/proxy/immich.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  services.nginx.upstreams.immich = {
+    servers = {
+      "10.89.88.13:2283" = { };
+      "[fd31:185d:722f::13]:2283" = { };
+    };
+  };
+
+  services.nginx.virtualHosts."immich.oxapentane.com" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://immich";
+      extraConfig = ''
+        client_max_body_size 50000M;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+        send_timeout 600s;
+      '';
+    };
+  };
+}

hosts/immich/default.nix

@@ -0,0 +1,78 @@
+
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:03";
+in
+{
+  imports = [
+    ./immich.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 4 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-immich";
+        mac = mac;
+      }
+    ];
+    shares =
+      [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "store";
+          proto = "virtiofs";
+          socket = "store.socket";
+        }
+      ]
+      ++ map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.13/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "immich";
+  system.stateVersion = "24.11";
+}

hosts/immich/immich.nix

@@ -0,0 +1,19 @@
+{ config, ... }:
+{
+  sops.secrets."immich.yaml" = {
+    sopsFile = ./immich.yaml;
+    owner = config.services.immich.user;
+    key = "";
+  };
+
+  services.immich = {
+    enable = true;
+    host = "10.89.88.13";
+    redis.enable = true;
+    database.createDB = true;
+    settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815
+    environment = {
+      IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path;
+    };
+  };
+}

hosts/immich/immich.yaml

@@ -0,0 +1,49 @@
+server:
+    externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str]
+oauth:
+    enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool]
+    autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool]
+    autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool]
+    clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str]
+    clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str]
+    issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS
+            aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT
+            cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ
+            Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9
+            7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-24T20:10:57Z"
+    mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str]
+    pgp:
+        - created_at: "2025-01-24T20:02:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb
+            UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1
+            c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF
+            0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx
+            tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7
+            3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K
+            fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ
+            5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC
+            /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U
+            6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb
+            pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS
+            XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX
+            ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU=
+            =sCmm
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

hosts/immich/secrets.yaml

@@ -0,0 +1,42 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiU3BSLzg3c2FMMjlnNDgw
+            RktIM1FyakRzNURLdHpYcmNudW9BT0JlQmpjCjg2WEE1SFBxWlQzeTdmOGZhSGwr
+            cHRaT0FJcnN6TTJtYXFEeFM0RlNRNVkKLS0tIGoyKzRhdDRPRlBJZzJ0M2IwdGZN
+            eUVaVTdsMHJRRVA4WjNCTjYySlo3UlUKFph90mF2p5fclE8AuYvWbDrWXLIJO5gL
+            tI6pCM+fmY4WQoDTIAfSyXOSF0x29JYPfnIFCtnmYM/0ILzSDyWpGw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-21T17:43:24Z"
+    mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str]
+    pgp:
+        - created_at: "2025-01-21T17:42:17Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ/8Df3Q3j5ibjLMxw+n4qekGsL9Mc1o+T36GS8rTsSh8AYw
+            J+Ezh/D/q27lnqMxf5l81yeni6bFDPcDiVw3lquhvAm+8xmsM8NAh+HCGYkLN4y4
+            Ce3eHKAlR4q9ygfXggvbdddKLGz2PPmKgBJhSyaKVhcCGQMAsCrJOT2j9WgjcJg/
+            vkaaKVViFmlszwhoF7x/tgK6Pgrb3LDMcoeMu4vrLKqth2VrHpsGZ2WQ0YaS/njB
+            A83bAefTkoaY2g3INDo5RPs5Dv4kwOVg7Qyl6+8TD0FWs/T1lObjWS0Z2OfOoMX5
+            R9k+BZmj2WObx/+yRe+pqsRMWqiE89ABjDdoP+0md1q4UTly78P1gQi6OZ0EpIaI
+            Gw4QnZxCvWX/e1iJ47xMCq7Qpa+jmljGjQ2b6Vf3WmkEZLUdKnj5aUppRxLYrTgS
+            7eYNySEOXUBfI9CIwlP8qMM8XC63gJ8LqP8H6bHoqo1yHiDBET8FBMHZfxOxQUcM
+            mCmrUIj+k1C4Q/6z2GkC9LcZqbQ6NTDeGbWbQslVGX9FFjGtlGQ21v3eOU9yT0I2
+            RCpIhCjdQuxTdAVoawrMpURmUr5mdpSavjHc1PnWTldC0ugzJAXeOHh7l5vZI6Wh
+            R4vPUOxz+nHyGCeb3pETf0S2X/P7Lp97y7v2r2Jtn8L7EPkSt0sJQDpLoSW0JcPS
+            XgHdusbP/tkBfkzkyybGkvUxiLSxUbn5HoRAC71P505snUOq2FivpNNUQLS6Un+B
+            FMHHfMmE/yymeXMsbcKHPfE9D3NdChPZM9EysmqubxPVAHRxZmpdYudne4Qn90o=
+            =rEC+
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3

hosts/minime/uvm.nix

@@ -1,6 +1,11 @@
 { inputs, ... }:
 {
   microvm.stateDir = "/var/lib/microvms";
+  microvm.autostart = [
+    "auth"
+    "radicale"
+    "immich"
+  ];
   microvm.vms = {
     auth = {
       flake = inputs.self;
@@ -10,5 +15,9 @@
       flake = inputs.self;
       updateFlake = "github:gshipunov/nix-config/master";
     };
+    immich = {
+      flake = inputs.self;
+      updateFlake = "github:gshipunov/nix-config/master";
+    };
   };
 }

modules/wg/proxy.nix

@@ -39,6 +39,14 @@
           publicKey = "EIdTwWTqGJv9i2rV+Uu8d/QptGwFAFjHcHp/Hquhr3g=";
           privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
         };
+        "immich" = {
+          address = [
+            "10.89.88.13/24"
+            "fd31:185d:722f::13/48"
+          ];
+          publicKey = "NXBlfKx4udjI6C7Dcp1Us7lYnE+L0avnMb1VSLxj42s=";
+          privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+        };
       };
     }
   ];