summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.sops.yaml7
-rw-r--r--flake.nix13
-rw-r--r--hosts/cloud/proxy/default.nix1
-rw-r--r--hosts/cloud/proxy/immich.nix33
-rw-r--r--hosts/immich/default.nix78
-rw-r--r--hosts/immich/immich.nix19
-rw-r--r--hosts/immich/immich.yaml49
-rw-r--r--hosts/immich/secrets.yaml42
-rw-r--r--hosts/minime/uvm.nix9
-rw-r--r--modules/wg/proxy.nix8
10 files changed, 259 insertions, 0 deletions
diff --git a/.sops.yaml b/.sops.yaml
index 9e590d1..2a59089 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -7,6 +7,7 @@ keys:
# microvms
- &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
- &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
+ - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
creation_rules:
- path_regex: hosts/toaster/[^/]+\.yaml$
key_groups:
@@ -38,3 +39,9 @@ creation_rules:
- *admin_oxa
age:
- *radicale
+ - path_regex: hosts/immich/[^/]+\.yaml$
+ key_groups:
+ - pgp:
+ - *admin_oxa
+ age:
+ - *immich
diff --git a/flake.nix b/flake.nix
index 44869f9..805f1e1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -129,6 +129,19 @@
];
};
+ immich = nixpkgs.lib.nixosSystem {
+ system = "x86_64-linux";
+ specialArgs = { inherit inputs; };
+ modules = [
+ sops-nix.nixosModules.sops
+ microvm.nixosModules.microvm
+
+ ./hosts/immich
+ ./modules/server
+ ./modules/wg
+ ];
+ };
+
radicale = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs; };
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix
index d727f06..438e47c 100644
--- a/hosts/cloud/proxy/default.nix
+++ b/hosts/cloud/proxy/default.nix
@@ -3,6 +3,7 @@
imports = [
./auth.nix
./dav.nix
+ ./immich.nix
];
networking.firewall.allowedTCPPorts = [
diff --git a/hosts/cloud/proxy/immich.nix b/hosts/cloud/proxy/immich.nix
new file mode 100644
index 0000000..93e62d2
--- /dev/null
+++ b/hosts/cloud/proxy/immich.nix
@@ -0,0 +1,33 @@
+{ ... }:
+{
+ services.nginx.upstreams.immich = {
+ servers = {
+ "10.89.88.13:2283" = { };
+ "[fd31:185d:722f::13]:2283" = { };
+ };
+ };
+
+ services.nginx.virtualHosts."immich.oxapentane.com" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/" = {
+ proxyPass = "http://immich";
+ extraConfig = ''
+ client_max_body_size 50000M;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ proxy_read_timeout 600s;
+ proxy_send_timeout 600s;
+ send_timeout 600s;
+ '';
+ };
+ };
+}
diff --git a/hosts/immich/default.nix b/hosts/immich/default.nix
new file mode 100644
index 0000000..5c3db21
--- /dev/null
+++ b/hosts/immich/default.nix
@@ -0,0 +1,78 @@
+
+{ config, lib, ... }:
+let
+ mac = "02:00:00:00:00:03";
+in
+{
+ imports = [
+ ./immich.nix
+ ];
+ sops.defaultSopsFile = ./secrets.yaml;
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+ sops.secrets = {
+ "wg/0xa-proxy" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ };
+
+ microvm = {
+ hypervisor = "qemu";
+ mem = 4 * 1024;
+ vcpu = 2;
+ interfaces = [
+ {
+ type = "tap";
+ id = "uvm-immich";
+ mac = mac;
+ }
+ ];
+ shares =
+ [
+ {
+ source = "/nix/store";
+ mountPoint = "/nix/.ro-store";
+ tag = "store";
+ proto = "virtiofs";
+ socket = "store.socket";
+ }
+ ]
+ ++ map
+ (dir: {
+ source = dir;
+ mountPoint = "/${dir}";
+ tag = dir;
+ proto = "virtiofs";
+ socket = "${dir}.socket";
+ })
+ [
+ "etc"
+ "var"
+ "home"
+ ];
+ };
+
+ networking.useNetworkd = true;
+ networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+ systemd.network = {
+ enable = true;
+ networks."11-host" = {
+ matchConfig.MACAddress = mac;
+ networkConfig = {
+ Address = "10.99.99.13/24";
+ DHCP = "no";
+ };
+ routes = [
+ {
+ Gateway = "10.99.99.1";
+ Destination = "0.0.0.0/0";
+ Metric = 1024;
+ }
+ ];
+ };
+ };
+
+ networking.hostName = "immich";
+ system.stateVersion = "24.11";
+}
diff --git a/hosts/immich/immich.nix b/hosts/immich/immich.nix
new file mode 100644
index 0000000..aa220bf
--- /dev/null
+++ b/hosts/immich/immich.nix
@@ -0,0 +1,19 @@
+{ config, ... }:
+{
+ sops.secrets."immich.yaml" = {
+ sopsFile = ./immich.yaml;
+ owner = config.services.immich.user;
+ key = "";
+ };
+
+ services.immich = {
+ enable = true;
+ host = "10.89.88.13";
+ redis.enable = true;
+ database.createDB = true;
+ settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815
+ environment = {
+ IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path;
+ };
+ };
+}
diff --git a/hosts/immich/immich.yaml b/hosts/immich/immich.yaml
new file mode 100644
index 0000000..54075df
--- /dev/null
+++ b/hosts/immich/immich.yaml
@@ -0,0 +1,49 @@
+server:
+ externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str]
+oauth:
+ enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool]
+ autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool]
+ autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool]
+ clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str]
+ clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str]
+ issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS
+ aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT
+ cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ
+ Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9
+ 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-01-24T20:10:57Z"
+ mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str]
+ pgp:
+ - created_at: "2025-01-24T20:02:34Z"
+ enc: |-
+ -----BEGIN PGP MESSAGE-----
+
+ hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb
+ UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1
+ c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF
+ 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx
+ tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7
+ 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K
+ fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ
+ 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC
+ /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U
+ 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb
+ pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS
+ XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX
+ ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU=
+ =sCmm
+ -----END PGP MESSAGE-----
+ fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+ unencrypted_suffix: _unencrypted
+ version: 3.9.2
diff --git a/hosts/immich/secrets.yaml b/hosts/immich/secrets.yaml
new file mode 100644
index 0000000..5639aa7
--- /dev/null
+++ b/hosts/immich/secrets.yaml
@@ -0,0 +1,42 @@
+wg:
+ 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiU3BSLzg3c2FMMjlnNDgw
+ RktIM1FyakRzNURLdHpYcmNudW9BT0JlQmpjCjg2WEE1SFBxWlQzeTdmOGZhSGwr
+ cHRaT0FJcnN6TTJtYXFEeFM0RlNRNVkKLS0tIGoyKzRhdDRPRlBJZzJ0M2IwdGZN
+ eUVaVTdsMHJRRVA4WjNCTjYySlo3UlUKFph90mF2p5fclE8AuYvWbDrWXLIJO5gL
+ tI6pCM+fmY4WQoDTIAfSyXOSF0x29JYPfnIFCtnmYM/0ILzSDyWpGw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-01-21T17:43:24Z"
+ mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str]
+ pgp:
+ - created_at: "2025-01-21T17:42:17Z"
+ enc: |-
+ -----BEGIN PGP MESSAGE-----
+
+ hQIMA7zUOKwzpAE7AQ/8Df3Q3j5ibjLMxw+n4qekGsL9Mc1o+T36GS8rTsSh8AYw
+ J+Ezh/D/q27lnqMxf5l81yeni6bFDPcDiVw3lquhvAm+8xmsM8NAh+HCGYkLN4y4
+ Ce3eHKAlR4q9ygfXggvbdddKLGz2PPmKgBJhSyaKVhcCGQMAsCrJOT2j9WgjcJg/
+ vkaaKVViFmlszwhoF7x/tgK6Pgrb3LDMcoeMu4vrLKqth2VrHpsGZ2WQ0YaS/njB
+ A83bAefTkoaY2g3INDo5RPs5Dv4kwOVg7Qyl6+8TD0FWs/T1lObjWS0Z2OfOoMX5
+ R9k+BZmj2WObx/+yRe+pqsRMWqiE89ABjDdoP+0md1q4UTly78P1gQi6OZ0EpIaI
+ Gw4QnZxCvWX/e1iJ47xMCq7Qpa+jmljGjQ2b6Vf3WmkEZLUdKnj5aUppRxLYrTgS
+ 7eYNySEOXUBfI9CIwlP8qMM8XC63gJ8LqP8H6bHoqo1yHiDBET8FBMHZfxOxQUcM
+ mCmrUIj+k1C4Q/6z2GkC9LcZqbQ6NTDeGbWbQslVGX9FFjGtlGQ21v3eOU9yT0I2
+ RCpIhCjdQuxTdAVoawrMpURmUr5mdpSavjHc1PnWTldC0ugzJAXeOHh7l5vZI6Wh
+ R4vPUOxz+nHyGCeb3pETf0S2X/P7Lp97y7v2r2Jtn8L7EPkSt0sJQDpLoSW0JcPS
+ XgHdusbP/tkBfkzkyybGkvUxiLSxUbn5HoRAC71P505snUOq2FivpNNUQLS6Un+B
+ FMHHfMmE/yymeXMsbcKHPfE9D3NdChPZM9EysmqubxPVAHRxZmpdYudne4Qn90o=
+ =rEC+
+ -----END PGP MESSAGE-----
+ fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+ unencrypted_suffix: _unencrypted
+ version: 3.9.3
diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix
index 0437cdf..437f873 100644
--- a/hosts/minime/uvm.nix
+++ b/hosts/minime/uvm.nix
@@ -1,6 +1,11 @@
{ inputs, ... }:
{
microvm.stateDir = "/var/lib/microvms";
+ microvm.autostart = [
+ "auth"
+ "radicale"
+ "immich"
+ ];
microvm.vms = {
auth = {
flake = inputs.self;
@@ -10,5 +15,9 @@
flake = inputs.self;
updateFlake = "github:gshipunov/nix-config/master";
};
+ immich = {
+ flake = inputs.self;
+ updateFlake = "github:gshipunov/nix-config/master";
+ };
};
}
diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix
index 8885269..5dae4c4 100644
--- a/modules/wg/proxy.nix
+++ b/modules/wg/proxy.nix
@@ -39,6 +39,14 @@
publicKey = "EIdTwWTqGJv9i2rV+Uu8d/QptGwFAFjHcHp/Hquhr3g=";
privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
};
+ "immich" = {
+ address = [
+ "10.89.88.13/24"
+ "fd31:185d:722f::13/48"
+ ];
+ publicKey = "NXBlfKx4udjI6C7Dcp1Us7lYnE+L0avnMb1VSLxj42s=";
+ privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+ };
};
}
];
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 03:27:29 +0000