From 5417fb25cc0babeac3a8424ea63d863c957c937c Mon Sep 17 00:00:00 2001 From: dish Date: Mon, 1 Dec 2025 12:05:46 -0500 Subject: [PATCH] [marvin] immich config in repo --- hosts/marvin/services/immich-config.json | 234 ++++++++++++++++++ hosts/marvin/services/immich.nix | 17 +- .../services/secrets/immich/mail-pw.age | 19 ++ .../services/secrets/immich/oauth-secret.age | 19 ++ hosts/marvin/services/secrets/secrets.nix | 2 + 5 files changed, 290 insertions(+), 1 deletion(-) create mode 100644 hosts/marvin/services/immich-config.json create mode 100644 hosts/marvin/services/secrets/immich/mail-pw.age create mode 100644 hosts/marvin/services/secrets/immich/oauth-secret.age diff --git a/hosts/marvin/services/immich-config.json b/hosts/marvin/services/immich-config.json new file mode 100644 index 00000000..a16b3017 --- /dev/null +++ b/hosts/marvin/services/immich-config.json @@ -0,0 +1,234 @@ +{ + "backup": { + "database": { + "cronExpression": "0 02 * * *", + "enabled": true, + "keepLastAmount": 14 + } + }, + "ffmpeg": { + "accel": "vaapi", + "accelDecode": true, + "acceptedAudioCodecs": [ + "aac", + "mp3", + "libopus" + ], + "acceptedContainers": [ + "mov", + "ogg", + "webm" + ], + "acceptedVideoCodecs": [ + "h264" + ], + "bframes": -1, + "cqMode": "auto", + "crf": 23, + "gopSize": 0, + "maxBitrate": "0", + "preferredHwDevice": "auto", + "preset": "ultrafast", + "refs": 0, + "targetAudioCodec": "aac", + "targetResolution": "720", + "targetVideoCodec": "h264", + "temporalAQ": false, + "threads": 0, + "tonemap": "hable", + "transcode": "required", + "twoPass": false + }, + "image": { + "colorspace": "p3", + "extractEmbedded": false, + "fullsize": { + "enabled": false, + "format": "jpeg", + "quality": 80 + }, + "preview": { + "format": "jpeg", + "quality": 80, + "size": 1440 + }, + "thumbnail": { + "format": "webp", + "quality": 80, + "size": 250 + } + }, + "job": { + "backgroundTask": { + "concurrency": 5 + }, + "faceDetection": { + "concurrency": 2 + }, + "library": { + "concurrency": 5 + }, + "metadataExtraction": { + "concurrency": 5 + }, + "migration": { + "concurrency": 5 + }, + "notifications": { + "concurrency": 5 + }, + "ocr": { + "concurrency": 1 + }, + "search": { + "concurrency": 5 + }, + "sidecar": { + "concurrency": 5 + }, + "smartSearch": { + "concurrency": 2 + }, + "thumbnailGeneration": { + "concurrency": 3 + }, + "videoConversion": { + "concurrency": 1 + }, + "workflow": { + "concurrency": 5 + } + }, + "library": { + "scan": { + "cronExpression": "0 0 * * *", + "enabled": true + }, + "watch": { + "enabled": false + } + }, + "logging": { + "enabled": true, + "level": "log" + }, + "machineLearning": { + "availabilityChecks": { + "enabled": true, + "interval": 30000, + "timeout": 2000 + }, + "clip": { + "enabled": true, + "modelName": "ViT-B-32__openai" + }, + "duplicateDetection": { + "enabled": true, + "maxDistance": 0.01 + }, + "enabled": true, + "facialRecognition": { + "enabled": true, + "maxDistance": 0.5, + "minFaces": 3, + "minScore": 0.7, + "modelName": "buffalo_l" + }, + "ocr": { + "enabled": true, + "maxResolution": 736, + "minDetectionScore": 0.5, + "minRecognitionScore": 0.8, + "modelName": "PP-OCRv5_mobile" + }, + "urls": [ + "http://localhost:3003" + ] + }, + "map": { + "darkStyle": "https://tiles.immich.cloud/v1/style/dark.json", + "enabled": true, + "lightStyle": "https://tiles.immich.cloud/v1/style/light.json" + }, + "metadata": { + "faces": { + "import": false + } + }, + "newVersionCheck": { + "enabled": false + }, + "nightlyTasks": { + "clusterNewFaces": true, + "databaseCleanup": true, + "generateMemories": true, + "missingThumbnails": true, + "startTime": "00:00", + "syncQuotaUsage": true + }, + "notifications": { + "smtp": { + "enabled": true, + "from": "dishNet Photos ", + "transport": { + "host": "mail.pyrox.dev", + "ignoreCert": false, + "port": 587, + "secure": true, + "username": "immich@pyrox.dev" + } + } + }, + "oauth": { + "autoLaunch": false, + "autoRegister": true, + "buttonText": "dishNet Auth", + "clientId": "f1312240-d9fc-4336-aca6-b98316867848", + "defaultStorageQuota": null, + "enabled": true, + "issuerUrl": "https://auth.pyrox.dev", + "mobileOverrideEnabled": false, + "mobileRedirectUri": "", + "profileSigningAlgorithm": "none", + "roleClaim": "admins", + "scope": "openid email profile", + "signingAlgorithm": "RS256", + "storageLabelClaim": "preferred_username", + "storageQuotaClaim": "immich_quota", + "timeout": 30000, + "tokenEndpointAuthMethod": "client_secret_post" + }, + "passwordLogin": { + "enabled": true + }, + "reverseGeocoding": { + "enabled": true + }, + "server": { + "externalDomain": "https://img.pyrox.dev", + "loginPageMessage": "", + "publicUsers": true + }, + "storageTemplate": { + "enabled": false, + "hashVerificationEnabled": true, + "template": "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}" + }, + "templates": { + "email": { + "albumInviteTemplate": "", + "albumUpdateTemplate": "", + "welcomeTemplate": "" + } + }, + "theme": { + "customCss": "" + }, + "trash": { + "days": 30, + "enabled": true + }, + "user": { + "deleteDelay": 7 + } +} diff --git a/hosts/marvin/services/immich.nix b/hosts/marvin/services/immich.nix index a27bf1af..453038c0 100644 --- a/hosts/marvin/services/immich.nix +++ b/hosts/marvin/services/immich.nix @@ -11,7 +11,10 @@ in redis.enable = true; mediaLocation = "/var/media/photos/"; accelerationDevices = [ "/dev/dri/renderD128" ]; - settings = null; + settings = (builtins.fromJSON (builtins.readFile ./immich-config.json)) // { + oauth.clientSecret._secret = config.age.secrets.immich-oauth-secret.path; + notifications.smtp.password._secret = config.age.secrets.immich-mail-pw.path; + }; }; immich-public-proxy = { enable = true; @@ -26,4 +29,16 @@ in "video" "render" ]; + age.secrets = { + immich-oauth-secret = { + file = ./secrets/immich/oauth-secret.age; + owner = "immich"; + group = "immich"; + }; + immich-mail-pw = { + file = ./secrets/immich/mail-pw.age; + owner = "immich"; + group = "immich"; + }; + }; } diff --git a/hosts/marvin/services/secrets/immich/mail-pw.age b/hosts/marvin/services/secrets/immich/mail-pw.age new file mode 100644 index 00000000..1934271a --- /dev/null +++ b/hosts/marvin/services/secrets/immich/mail-pw.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 iqBxIA 3PVJMF6BgxuDxN9NAEYqcZaYEUhK9TB5XprRyW13Kx0 +AIQQG+4/9SVPcfq9ZtL/JsWDmLvW03UiAJaJ1nHSckQ +-> ssh-rsa fFaiTA +ZPBI1w2a48Md+Rt92ssVcfxN26zTLCEalT+jG8SJBv07ouOzd4ibPq65m6uOQU/+ +EEgHe23fGsPP4oISWDUgVFxesLA3wjsTWmbVrkrBzGQNeNnevIRMcJu7vWDtby/+ +dVxPQIoXH0jPlcDQCm2lwOGD+du+Nb4PnVseRPDaXRypKKmx+J057FQemYBk4OWx +yUfbKV2gHHcuRTVUQG6XAQwWvhh4e25fyc+MzKZNPUK4c/SVibjAsUH+Edd+NaV5 +yxku5k4TFZkU69sl2zCdgWfYVTowTGYGyf4Kf+I/kl9m13zIk9vRpocgt4APaJnv +p+KxJvbYRiprWl+IzZg6TwXY5mA1IbvlppR4aak1pwaIE76CgF5mGNDGkviGndtP ++eCMIocp6lk2U0dJEYkBtmjNbxFh3dxOcirgdNDypYPlZTSGvSRGhpL4nUJRsR+l +A7rJ5aHH2B4Vi93zgSV0PWiWSA7899bzgN1kQKKIgYln6Tl8UxQSNt5L3L4VajuW +3UqCltyGWt/926BMS+GrDZSWCEtVsDs5XQqDKEx6D+iviHZJXniI+RhH/eM7FLjp +iXgCRkBIALo2lOiScpr2rtfGDViq3Nh64cIslEPiewjVFTCxkxH+LuQ1stukrNki +IF0+pZ65rgatMAdnZRFXfRxmywKD99z4WRHAxvYloXc +-> ssh-ed25519 wpmdHA SQlzD3yqbnoF0JHqPFFDUugbm8jlBsdntLzF/WlJbjo +FggpB1k5xbq62QNlwkocwjiWhEqNjHAxR/GwoPhXbC8 +--- 1g4f2OQbS5iXm/cqBamEWuapvZHorxfX7wHizfPcYsc +�z�92�LN=9���$O���fP���E���~�.��}7�eڰq�y�N�I�L���"%�V�lz'�أ� \ No newline at end of file diff --git a/hosts/marvin/services/secrets/immich/oauth-secret.age b/hosts/marvin/services/secrets/immich/oauth-secret.age new file mode 100644 index 00000000..2bd5c3e2 --- /dev/null +++ b/hosts/marvin/services/secrets/immich/oauth-secret.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 iqBxIA 4osfKV5/wFT7mCdc4TjP7pJHdD8wzV7VKKiBSGRqImk +wU6RSxJh8SBbXbiwCl4lXD/m1THoAg5n1Y7pyKFPiec +-> ssh-rsa fFaiTA +RTHaBLsBWbDEmY80LktVL/C6CeFinLm3/4t/hoWmbzLLoElBL86EGVdrE5ovjUYl +j5+ZacmqahwjCtF/ZGBt8MFkWOK9u90YDfLp+kb2ILVy/E+CcQ3xPpH9bf83pPl/ +aZmttaRlhnhSDYVXB0lHx3u/cCrYhTf6TjEoVGZ/XrLW0BRmO6GSwcmTrachZzdJ +je+pf2ug//mnAJR0y4MxjGlNPD/Vaj/UiaFQjPT+7ZvUUSkbv/QpPqyhhosFA11e +1EGp21ppwUnJSNdYh2vulpQGurB5bPlv6Y8FpcFKivq/qKmA4ydyER3NcCca5Ly+ +01jQ1HRqWylYJj7K4hnxSjnNlOXCrJATuPJYoNdt2U1DnolUAqL6JIP/qNmYx8Fb +ZrfFINBmPsNc9XJn14T4J+VB6e68ODBOvZdbzoBQOWAObnP5OH+zLYCB3II+aLPp +Zo5WsNBBdZih4EbO0Y9PNWBjyCzxqs7zXPg1PjjDVHN/tIpSGnqoCqCPGuePhgRV +h1gnP/lqOW2U1oL004hi3etsUsk3kXHjr35GXMVBeay+3uGXkZqhNYYSluQnJSrs +rzahZZ8/q0FDdlUixWHb2uQjL1XMTqUcw8wPsUak8shkx8s7GPKNxtEKFcK46jk4 +ac9TCyee4HzPC/SWkLGFl0bt9s9lGTBSNQrVzogY/sg +-> ssh-ed25519 wpmdHA C6npqn5aqimGJlo+UlvYOoqXSu/hW1JVNAmBPP1Vvjk +gWzXqL92jI83iqSr3dydJo+UAz5OGBo6kw6QC4KRWgM +--- ltHFDmeAbJsQtyY4CKFEz8OGAkPkue/8upHNOOQgn5I +��O�ӌ#&`���P�IZ�#�[��+�tdeG�ui�����?n"��(��b� ]s� y줔��� \ No newline at end of file diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix index ed6674b6..6312b829 100644 --- a/hosts/marvin/services/secrets/secrets.nix +++ b/hosts/marvin/services/secrets/secrets.nix @@ -27,6 +27,8 @@ in "golink-authkey.age".publicKeys = marvinDefault; "grafana-admin-password.age".publicKeys = marvinDefault; "grafana-smtp-password.age".publicKeys = marvinDefault; + "immich/oauth-secret.age".publicKeys = marvinDefault; + "immich/mail-pw.age".publicKeys = marvinDefault; "jellyfin-exporter-config.age".publicKeys = marvinDefault; "minio-root.age".publicKeys = marvinDefault; "miniflux-admin.age".publicKeys = marvinDefault; -- 2.51.2