alyssum/immich: init

containers/emerald/flake.nix

@@ -39,7 +39,7 @@
         useACMEHost = "lava.moe";
         forceSSL = true;
         locations."/".proxyPass = "http://[${client}]:4533";
-        listenAddresses = [ "100.67.2.1" ];
+        listenAddresses = config.me.localAddrs;
       };
 
       systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];

hosts/alyssum/default.nix

@@ -34,6 +34,7 @@
     ./filesystem.nix
     ./kernel.nix
     ./home.syncthing.nix
+    ./immich.nix
     ./networking.nix
     ./restic.nix
     ./samba.nix

hosts/alyssum/immich.nix

@@ -0,0 +1,28 @@
+{ config, ... }: {
+  services.immich = {
+    enable = true;
+    accelerationDevices = null;
+    settings.server.externalDomain = "https://photos.lava.moe";
+  };
+
+  me.binds."/var/lib/immich" = "immich";
+  hardware.graphics.enable = true;
+  users.users.immich.extraGroups = [ "video" "render" ];
+
+  services.nginx.virtualHosts."photos.lava.moe" = {
+    useACMEHost = "lava.moe";
+    forceSSL = true;
+    listenAddresses = config.me.localAddrs;
+
+    locations."/" = {
+      proxyPass = "http://[::1]:${toString config.services.immich.port}";
+      proxyWebsockets = true;
+      extraConfig = ''
+        client_max_body_size 50000M;
+        proxy_read_timeout   600s;
+        proxy_send_timeout   600s;
+        send_timeout         600s;
+      '';
+    };
+  };
+}

hosts/alyssum/networking.nix

@@ -12,4 +12,5 @@
     defaultGateway = "192.168.1.1";
     nameservers = [ "8.8.8.8" "8.8.4.4" ];
   };
+  me.localAddrs = [ "100.67.2.1" ];
 }

modules/options.nix

@@ -49,5 +49,9 @@ in {
       type = with lib.types; attrsOf str;
       default = {};
     };
+
+    localAddrs = lib.mkOption {
+      type = with lib.types; listOf str;
+    };
   };
 }