blob: 3e1bf48005f3ba21a70e761e7524535149a301fe (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
{ config, pkgs, ... }:
{
services.nginx.clientMaxBodySize = "100m";
services.nginx.virtualHosts."photo.emile.space" = {
forceSSL = true;
enableACME = true;
locations = {
# # immich private proxy
# "/share" = {
# proxyPass = "http://${config.services.immich.host}:${toString config.services.immich-public-proxy.port}";
# };
# "/share/*" = {
# proxyPass = "http://${config.services.immich.host}:${toString config.services.immich-public-proxy.port}";
# };
# immich
"/" = {
proxyPass = "http://${config.services.immich.host}:${toString config.services.immich.port}";
proxyWebsockets = true;
};
};
};
age.secrets.immich_oidc_client_secret.owner = "authelia-main";
age.secrets.immich_oidc_client_secret.group = "authelia-main";
# auth via authelia
services.authelia.instances.main.settings.identity_providers.oidc.clients = [
{
client_id = "Immich";
# ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
client_secret = "{{ secret \"${config.age.secrets.immich_oidc_client_secret.path}\" }}";
public = false;
authorization_policy = "two_factor";
redirect_uris = [
"https://photo.emile.space/auth/login"
"https://photo.emile.space/user-settings"
"app.immich:///oauth-callback"
];
scopes = [
"openid"
"email"
"profile"
];
#grant_types = [
# "refresh_token"
# "authorization_code"
#];
#response_types = [ "code" ];
#response_modes = [
# "form_post"
# "query"
# "fragment"
#];
# token_endpoint_auth_method = "client_secret_basic";
# might be needed since the upgrade to nixos-24.11 and the resulting
# 4.37.5 -> 4.38.17 upgrade
token_endpoint_auth_method = "client_secret_post";
}
];
services.immich = {
enable = true;
package = pkgs.immich;
mediaLocation = "/var/lib/immich";
secretsFile = config.age.secrets.immich_secrets_file.path;
host = "127.0.0.1";
port = config.emile.ports.photo.immich;
machine-learning = {
enable = false;
environment = {
MACHINE_LEARNING_MODEL_TTL = "600";
};
};
};
# services.immich-public-proxy = {
# enable = true;
# package = pkgs.immich-public-proxy;
# settings = {
# downloadOriginalPhoto = true;
# showGalleryTitle = true;
# allowDownloadAll = 1;
# showHomePage = true;
# showMetadata = true;
# };
# port = config.emile.ports.photo.immich-public-proxy;
# openFirewall = false;
# immichUrl = "photo.emile.space";
# };
}
|
