feat: inital public commit

2025-08-15 19:27:17 -04:00
commit b48074e201
55 changed files with 2521 additions and 0 deletions
--- a/host/ark/service/photos.nix
+++ b/host/ark/service/photos.nix
@@ -0,0 +1,117 @@
+{ lib, config, pkgs, ... }: {
+  sops = {
+    templates = {
+      "immich-config.json" = {
+        content = builtins.toJSON {
+          passwordLogin.enabled = false;
+
+          # We will do this ourselves
+          backup.database.enabled = false;
+
+          oauth = {
+            enabled = true;
+            autoLaunch = true;
+            autoRegister = true;
+            buttonText =
+              lib.strings.concatStrings [ "Login To " config.oauth.name ];
+            clientId = config.sops.placeholder."photos/clientId";
+            clientSecret = config.sops.placeholder."photos/clientSecret";
+            issuerUrl = "https://auth.koon.us/.well-known/openid-configuration";
+          };
+        };
+        owner = config.users.users.immich.name;
+        mode = "0400";
+        restartUnits = [ "immich-server.service" "pocket-id.service" ];
+      };
+    };
+  };
+
+  services.immich = {
+    enable = true;
+    port = 2283;
+    environment.IMMICH_CONFIG_FILE = config.sops.templates."immich-config.json".path;
+    accelerationDevices = null;
+
+    machine-learning.environment = {
+      HF_XET_CACHE = "/var/cache/immich/huggingface-xet";
+    };
+
+  };
+
+  users.users.immich = {
+    home = "/var/lib/immich";
+    createHome = true;
+    extraGroups = [ "video" "render" ];
+  };
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [ intel-media-driver ];
+  };
+  environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; };
+
+  services.restic.backups = {
+    immich-local = {
+      repository = "/mnt/hdd/restic/immich";
+      passwordFile = config.sops.secrets.restic-password.path;
+      initialize = true;
+      paths = [ "/var/lib/immich/upload" "/var/backup/immich" ];
+      backupPrepareCommand = ''
+        mkdir -p /var/backup/immich
+
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-server
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-machine-learning
+
+        ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump \
+          --clean \
+          --if-exists \
+          --dbname=immich > /var/backup/immich/postgres.sql
+      '';
+      backupCleanupCommand = ''
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-server
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-machine-learning
+      '';
+    };
+    immich-remote = {
+      repository = "rest:http://m1:8000/immich";
+      passwordFile = config.sops.secrets.restic-password.path;
+      initialize = true;
+      paths = [ "/var/lib/immich/upload" "/var/backup/immich" ];
+      backupPrepareCommand = ''
+        mkdir -p /var/backup/immich
+
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-server
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-machine-learning
+
+        ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump \
+          --clean \
+          --if-exists \
+          --dbname=immich > /var/backup/immich/postgres.sql
+      '';
+      backupCleanupCommand = ''
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-server
+        ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-machine-learning
+      '';
+    };
+  };
+
+  environment.systemPackages = with pkgs;
+    let
+      scripts = with pkgs; {
+        restore_immich_pg = writeShellScriptBin "restore_immich_pg" ''
+          ${pkgs.sudo}/bin/sudo -u postgres psql --dbname=immich < /var/backup/immich/postgres.sql
+        '';
+        restore_immich = writeShellScriptBin "restore_immich" ''
+          ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-server
+          ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl stop immich-machine-learning
+
+          ${pkgs.sudo}/bin/sudo ${restic}/bin/restic -r /mnt/hdd/restic/immich restore latest --target /
+
+          ${scripts.restore_immich_pg}/bin/restore_immich_pg
+
+          ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-server
+          ${pkgs.sudo}/bin/sudo ${pkgs.systemd}/bin/systemctl start immich-machine-learning
+        '';
+      };
+    in [ scripts.restore_immich_pg scripts.restore_immich ];
+}