From 2900bc2f17e60014977e10b283aa633fd68f3087 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Thu, 25 Jul 2024 20:06:27 +0100 Subject: [PATCH 1/4] immich,immich.machine-learning: init at 1.115.0 --- pkgs/by-name/im/immich/machine-learning.nix | 105 +++++++++ pkgs/by-name/im/immich/package.nix | 232 ++++++++++++++++++++ pkgs/by-name/im/immich/sources.json | 15 ++ pkgs/by-name/im/immich/update.sh | 40 ++++ 4 files changed, 392 insertions(+) create mode 100644 pkgs/by-name/im/immich/machine-learning.nix create mode 100644 pkgs/by-name/im/immich/package.nix create mode 100644 pkgs/by-name/im/immich/sources.json create mode 100755 pkgs/by-name/im/immich/update.sh diff --git a/pkgs/by-name/im/immich/machine-learning.nix b/pkgs/by-name/im/immich/machine-learning.nix new file mode 100644 index 000000000000..7a6451825118 --- /dev/null +++ b/pkgs/by-name/im/immich/machine-learning.nix @@ -0,0 +1,105 @@ +{ + lib, + src, + fetchFromGitHub, + immich, + python3, + # Override Python packages using + # self: super: { pkg = super.pkg.overridePythonAttrs (oldAttrs: { ... }); } + # Applied after defaultOverrides + packageOverrides ? self: super: { }, +}: +let + defaultOverrides = self: super: { + pydantic = super.pydantic_1; + + versioningit = super.versioningit.overridePythonAttrs (_: { + doCheck = false; + }); + + albumentations = super.albumentations.overridePythonAttrs (_: rec { + version = "1.4.3"; + src = fetchFromGitHub { + owner = "albumentations-team"; + repo = "albumentations"; + rev = version; + hash = "sha256-JIBwjYaUP4Sc1bVM/zlj45cz9OWpb/LOBsIqk1m+sQA="; + }; + }); + }; + + python = python3.override { + self = python; + packageOverrides = lib.composeExtensions defaultOverrides packageOverrides; + }; +in +python.pkgs.buildPythonApplication { + pname = "immich-machine-learning"; + inherit (immich) version; + src = "${src}/machine-learning"; + pyproject = true; + + postPatch = '' + substituteInPlace pyproject.toml --replace-fail 'fastapi-slim' 'fastapi' + ''; + + pythonRelaxDeps = [ "setuptools" ]; + pythonRemoveDeps = [ "opencv-python-headless" ]; + + build-system = with python.pkgs; [ + poetry-core + cython + ]; + + dependencies = + with python.pkgs; + [ + insightface + opencv4 + pillow + fastapi + uvicorn + aiocache + rich + ftfy + setuptools + python-multipart + orjson + gunicorn + huggingface-hub + tokenizers + pydantic + ] + ++ uvicorn.optional-dependencies.standard; + + doCheck = false; + + postInstall = '' + mkdir -p $out/share/immich + cp log_conf.json $out/share/immich + + cp -r ann $out/${python.sitePackages}/ + + makeWrapper ${lib.getExe python.pkgs.gunicorn} "''${!outputBin}"/bin/machine-learning \ + --prefix PYTHONPATH : "$out/${python.sitePackages}:$PYTHONPATH" \ + --set-default MACHINE_LEARNING_WORKERS 1 \ + --set-default MACHINE_LEARNING_WORKER_TIMEOUT 120 \ + --set-default MACHINE_LEARNING_CACHE_FOLDER /var/cache/immich \ + --set-default IMMICH_HOST "[::]" \ + --set-default IMMICH_PORT 3003 \ + --add-flags "app.main:app -k app.config.CustomUvicornWorker \ + -w \"\$MACHINE_LEARNING_WORKERS\" \ + -b \"\$IMMICH_HOST:\$IMMICH_PORT\" \ + -t \"\$MACHINE_LEARNING_WORKER_TIMEOUT\" + --log-config-json $out/share/immich/log_conf.json" + ''; + + meta = { + description = "Self-hosted photo and video backup solution (machine learning component)"; + homepage = "https://immich.app/"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ jvanbruegge ]; + mainProgram = "machine-learning"; + inherit (immich.meta) platforms; + }; +} diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix new file mode 100644 index 000000000000..ea64fd65945c --- /dev/null +++ b/pkgs/by-name/im/immich/package.nix @@ -0,0 +1,232 @@ +{ + lib, + stdenvNoCC, + buildNpmPackage, + fetchFromGitHub, + python3, + nodejs, + node-gyp, + runCommand, + nixosTests, + callPackage, + # build-time deps + glib, + pkg-config, + makeWrapper, + curl, + cacert, + unzip, + # runtime deps + ffmpeg-headless, + imagemagick, + libraw, + libheif, + vips, + perl, +}: +let + buildNpmPackage' = buildNpmPackage.override { inherit nodejs; }; + sources = lib.importJSON ./sources.json; + inherit (sources) version; + + buildLock = { + sources = + builtins.map + (p: { + name = p.pname; + inherit (p) version; + inherit (p.src) rev; + }) + [ + imagemagick + libheif + libraw + ]; + + packages = [ ]; + }; + + # The geodata website is not versioned, so we use the internet archive + geodata = + runCommand "immich-geodata" + { + outputHash = "sha256-imqSfzXaEMNo9T9tZr80sr/89n19kiFc8qwidFzRUaY="; + outputHashMode = "recursive"; + nativeBuildInputs = [ + cacert + curl + unzip + ]; + + meta.license = lib.licenses.cc-by-40; + } + '' + mkdir $out + url="https://web.archive.org/web/20240724153050/http://download.geonames.org/export/dump" + curl -Lo ./cities500.zip "$url/cities500.zip" + curl -Lo $out/admin1CodesASCII.txt "$url/admin1CodesASCII.txt" + curl -Lo $out/admin2Codes.txt "$url/admin2Codes.txt" + curl -Lo $out/ne_10m_admin_0_countries.geojson \ + https://raw.githubusercontent.com/nvkelso/natural-earth-vector/ca96624a56bd078437bca8184e78163e5039ad19/geojson/ne_10m_admin_0_countries.geojson + + unzip ./cities500.zip -d $out/ + echo "2024-07-24T15:30:50Z" > $out/geodata-date.txt + ''; + + src = fetchFromGitHub { + owner = "immich-app"; + repo = "immich"; + rev = "v${version}"; + inherit (sources) hash; + }; + + openapi = buildNpmPackage' { + pname = "immich-openapi-sdk"; + inherit version; + src = "${src}/open-api/typescript-sdk"; + inherit (sources.components."open-api/typescript-sdk") npmDepsHash; + + installPhase = '' + runHook preInstall + + npm config delete cache + npm prune --omit=dev --omit=optional + + mkdir -p $out + mv package.json package-lock.json node_modules build $out/ + + runHook postInstall + ''; + }; + + web = buildNpmPackage' { + pname = "immich-web"; + inherit version; + src = "${src}/web"; + inherit (sources.components.web) npmDepsHash; + + preBuild = '' + rm node_modules/@immich/sdk + ln -s ${openapi} node_modules/@immich/sdk + # Rollup does not find the dependency otherwise + ln -s node_modules/@immich/sdk/node_modules/@oazapfts node_modules/ + ''; + + installPhase = '' + runHook preInstall + + cp -r build $out + + runHook postInstall + ''; + }; + + node-addon-api = stdenvNoCC.mkDerivation rec { + pname = "node-addon-api"; + version = "8.0.0"; + src = fetchFromGitHub { + owner = "nodejs"; + repo = "node-addon-api"; + rev = "v${version}"; + hash = "sha256-k3v8lK7uaEJvcaj1sucTjFZ6+i5A6w/0Uj9rYlPhjCE="; + }; + installPhase = '' + mkdir $out + cp -r *.c *.h *.gyp *.gypi index.js package-support.json package.json tools $out/ + ''; + }; + + vips' = vips.overrideAttrs (prev: { + mesonFlags = prev.mesonFlags ++ [ "-Dtiff=disabled" ]; + }); +in +buildNpmPackage' { + pname = "immich"; + inherit version; + src = "${src}/server"; + inherit (sources.components.server) npmDepsHash; + + nativeBuildInputs = [ + pkg-config + python3 + makeWrapper + glib + node-gyp + ]; + + buildInputs = [ + ffmpeg-headless + imagemagick + libraw + libheif + vips' # Required for sharp + ]; + + # Required because vips tries to write to the cache dir + makeCacheWritable = true; + + preBuild = '' + cd node_modules/sharp + + mkdir node_modules + ln -s ${node-addon-api} node_modules/node-addon-api + + ${lib.getExe nodejs} install/check + + rm -r node_modules + + cd ../.. + rm -r node_modules/@img/sharp* + ''; + + installPhase = '' + runHook preInstall + + npm config delete cache + npm prune --omit=dev + + mkdir -p $out/build + mv package.json package-lock.json node_modules dist resources $out/ + ln -s ${web} $out/build/www + ln -s ${geodata} $out/build/geodata + + echo '${builtins.toJSON buildLock}' > $out/build/build-lock.json + + makeWrapper ${lib.getExe nodejs} $out/bin/admin-cli --add-flags $out/dist/main --add-flags cli + makeWrapper ${lib.getExe nodejs} $out/bin/server --add-flags $out/dist/main --chdir $out \ + --set IMMICH_BUILD_DATA $out/build --set NODE_ENV production \ + --suffix PATH : "${ + lib.makeBinPath [ + perl + ffmpeg-headless + ] + }" + + runHook postInstall + ''; + + passthru = { + tests = { + inherit (nixosTests) immich; + }; + + machine-learning = callPackage ./machine-learning.nix { inherit src; }; + + inherit + src + sources + web + geodata + ; + updateScript = ./update.sh; + }; + + meta = { + description = "Self-hosted photo and video backup solution"; + homepage = "https://immich.app/"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ jvanbruegge ]; + platforms = lib.platforms.linux; + mainProgram = "server"; + }; +} diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json new file mode 100644 index 000000000000..4d89ace2fc4a --- /dev/null +++ b/pkgs/by-name/im/immich/sources.json @@ -0,0 +1,15 @@ +{ + "version": "1.115.0", + "hash": "sha256-H2FCR55redomrDjnnCQys47AaYbWEmlxO5NJEcVMBwY=", + "components": { + "server": { + "npmDepsHash": "sha256-6CehRhPepspDpQW1h0Bx7EpH7hn42Ygqma/6wim14jA=" + }, + "web": { + "npmDepsHash": "sha256-ZmXfYktgOmMkDjfqSGyyflr2CmnC9yVnJ1gAcmd6A00=" + }, + "open-api/typescript-sdk": { + "npmDepsHash": "sha256-l1mLYFpFQjYxytY0ZWLq+ldUhZA6so0HqPgCABt0s9k=" + } + } +} diff --git a/pkgs/by-name/im/immich/update.sh b/pkgs/by-name/im/immich/update.sh new file mode 100755 index 000000000000..7b555a53914f --- /dev/null +++ b/pkgs/by-name/im/immich/update.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p curl jq prefetch-npm-deps nix-prefetch-github coreutils + +set -euo pipefail +cd "$(dirname "${BASH_SOURCE[0]}")" + +old_version=$(jq -r ".version" sources.json || echo -n "0.0.1") +version=$(curl -s "https://api.github.com/repos/immich-app/immich/releases/latest" | jq -r ".tag_name") +version="${version#v}" + +echo "Updating to $version" + +if [[ "$old_version" == "$version" ]]; then + echo "Already up to date!" + exit 0 +fi + +echo "Fetching src" +src_hash=$(nix-prefetch-github immich-app immich --rev "v${version}" | jq -r .hash) +upstream_src="https://raw.githubusercontent.com/immich-app/immich/v$version" + +sources_tmp="$(mktemp)" +cat < "$sources_tmp" +{ + "version": "$version", + "hash": "$src_hash", + "components": {} +} +EOF + +for npm_component in server web "open-api/typescript-sdk"; do + echo "fetching $npm_component" + hash=$(prefetch-npm-deps <(curl -s "$upstream_src/$npm_component/package-lock.json")) + echo "$(jq --arg npm_component "$npm_component" \ + --arg hash "$hash" \ + '.components += {($npm_component): {npmDepsHash: $hash}}' \ + "$sources_tmp")" > "$sources_tmp" +done + +cp "$sources_tmp" sources.json From f2ff5dc2678ef692ef3df452443fe976f6fe7849 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Thu, 25 Jul 2024 20:07:09 +0100 Subject: [PATCH 2/4] immich-cli: 2.2.15 -> 2.2.19 --- pkgs/by-name/im/immich-cli/package.nix | 36 +++++++++++++ pkgs/by-name/im/immich/sources.json | 13 +++-- pkgs/by-name/im/immich/update.sh | 10 ++-- pkgs/tools/misc/immich-cli/default.nix | 70 -------------------------- pkgs/top-level/all-packages.nix | 2 - 5 files changed, 53 insertions(+), 78 deletions(-) create mode 100644 pkgs/by-name/im/immich-cli/package.nix delete mode 100644 pkgs/tools/misc/immich-cli/default.nix diff --git a/pkgs/by-name/im/immich-cli/package.nix b/pkgs/by-name/im/immich-cli/package.nix new file mode 100644 index 000000000000..d41dc764f26d --- /dev/null +++ b/pkgs/by-name/im/immich-cli/package.nix @@ -0,0 +1,36 @@ +{ + lib, + immich, + buildNpmPackage, + nodejs, + makeWrapper, +}: +buildNpmPackage { + pname = "immich-cli"; + src = "${immich.src}/cli"; + inherit (immich.sources.components.cli) version npmDepsHash; + + nativeBuildInputs = [ makeWrapper ]; + + inherit (immich.web) preBuild; + + installPhase = '' + runHook preInstall + + mkdir -p $out + mv package.json package-lock.json node_modules dist $out/ + + makeWrapper ${lib.getExe nodejs} $out/bin/immich --add-flags $out/dist/index.js + + runHook postInstall + ''; + + meta = { + description = "Self-hosted photo and video backup solution (command line interface)"; + homepage = "https://immich.app/docs/features/command-line-interface"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ jvanbruegge ]; + inherit (nodejs.meta) platforms; + mainProgram = "immich"; + }; +} diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json index 4d89ace2fc4a..a07d6c0b1b29 100644 --- a/pkgs/by-name/im/immich/sources.json +++ b/pkgs/by-name/im/immich/sources.json @@ -2,14 +2,21 @@ "version": "1.115.0", "hash": "sha256-H2FCR55redomrDjnnCQys47AaYbWEmlxO5NJEcVMBwY=", "components": { + "cli": { + "npmDepsHash": "sha256-+zKtPHXjBd1KAKvI5xaY2/9qzVUg+8Ho/wrV9+TlU64=", + "version": "2.2.19" + }, "server": { - "npmDepsHash": "sha256-6CehRhPepspDpQW1h0Bx7EpH7hn42Ygqma/6wim14jA=" + "npmDepsHash": "sha256-6CehRhPepspDpQW1h0Bx7EpH7hn42Ygqma/6wim14jA=", + "version": "1.115.0" }, "web": { - "npmDepsHash": "sha256-ZmXfYktgOmMkDjfqSGyyflr2CmnC9yVnJ1gAcmd6A00=" + "npmDepsHash": "sha256-ZmXfYktgOmMkDjfqSGyyflr2CmnC9yVnJ1gAcmd6A00=", + "version": "1.115.0" }, "open-api/typescript-sdk": { - "npmDepsHash": "sha256-l1mLYFpFQjYxytY0ZWLq+ldUhZA6so0HqPgCABt0s9k=" + "npmDepsHash": "sha256-l1mLYFpFQjYxytY0ZWLq+ldUhZA6so0HqPgCABt0s9k=", + "version": "1.115.0" } } } diff --git a/pkgs/by-name/im/immich/update.sh b/pkgs/by-name/im/immich/update.sh index 7b555a53914f..1558577b8b60 100755 --- a/pkgs/by-name/im/immich/update.sh +++ b/pkgs/by-name/im/immich/update.sh @@ -28,13 +28,17 @@ cat < "$sources_tmp" } EOF -for npm_component in server web "open-api/typescript-sdk"; do +lock=$(mktemp) +for npm_component in cli server web "open-api/typescript-sdk"; do echo "fetching $npm_component" - hash=$(prefetch-npm-deps <(curl -s "$upstream_src/$npm_component/package-lock.json")) + curl -s -o "$lock" "$upstream_src/$npm_component/package-lock.json" + hash=$(prefetch-npm-deps "$lock") echo "$(jq --arg npm_component "$npm_component" \ --arg hash "$hash" \ - '.components += {($npm_component): {npmDepsHash: $hash}}' \ + --arg version "$(jq -r '.version' <"$lock")" \ + '.components += {($npm_component): {npmDepsHash: $hash, version: $version}}' \ "$sources_tmp")" > "$sources_tmp" done +rm "$lock" cp "$sources_tmp" sources.json diff --git a/pkgs/tools/misc/immich-cli/default.nix b/pkgs/tools/misc/immich-cli/default.nix deleted file mode 100644 index 8cf8212f8a83..000000000000 --- a/pkgs/tools/misc/immich-cli/default.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ lib -, buildNpmPackage -, fetchFromGitHub -, testers -}: - -let - version = "2.2.15"; - src = fetchFromGitHub { - owner = "immich-app"; - repo = "immich"; - # Using a fixed commit until upstream has release tags for cli. - rev = "f7bfde6a3286d4b454c2f05ccf354914f8eccac6"; - hash = "sha256-O014Y2HwhfPqKKFFGtNDJBzCaR6ugI4azw6/kfzKET0="; - }; - meta' = { - description = "CLI utilities for Immich to help upload images and videos"; - homepage = "https://github.com/immich-app/immich"; - license = lib.licenses.mit; - maintainers = with lib.maintainers; [ felschr pineapplehunter ]; - mainProgram = "immich"; - }; - - open-api-typescript-sdk = buildNpmPackage { - pname = "immich-cli-openapi-typescript-sdk"; - inherit src version; - - npmDepsHash = "sha256-rIN88xw8kdLfhFbT4OReTwzWqNlD4QVAAuvfMyda+V8="; - - postPatch = '' - cd open-api/typescript-sdk - ''; - meta = { - # using inherit for `builtin.unsafeGetAttrPos` to work correctly - inherit (meta') - description - homepage - license - maintainers; - }; - }; - - immich-cli = buildNpmPackage { - pname = "immich-cli"; - inherit src version; - - npmDepsHash = "sha256-r/kCE6FmhbnMVv2Z76hH/1O1YEYSq9VY5kB0xlqWzaM="; - - postPatch = '' - ln -sv ${open-api-typescript-sdk}/lib/node_modules/@immich/sdk/{build,node_modules} open-api/typescript-sdk - cd cli - ''; - - passthru = { - inherit open-api-typescript-sdk; - tests.version = testers.testVersion { package = immich-cli; }; - }; - - meta = { - # using inherit for `builtin.unsafeGetAttrPos` to work correctly - inherit (meta') - description - homepage - license - maintainers - mainProgram; - }; - }; -in -immich-cli diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index f7bd5bedd49e..583c01ddb5cc 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1796,8 +1796,6 @@ with pkgs; hyperpotamus = callPackage ../tools/misc/hyperpotamus { }; - immich-cli = callPackage ../tools/misc/immich-cli { }; - inherit (callPackages ../tools/networking/ivpn/default.nix {}) ivpn ivpn-service; jobber = callPackage ../tools/system/jobber { }; From cedcd9f4f02c02b1d684f0e15e5d2e7104f14cea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Tue, 2 Jul 2024 17:34:36 +0100 Subject: [PATCH 3/4] nixos/immich: init module --- .../manual/release-notes/rl-2411.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/web-apps/immich.nix | 311 ++++++++++++++++++ 3 files changed, 314 insertions(+) create mode 100644 nixos/modules/services/web-apps/immich.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index c9be54b109c1..ca5bb5690779 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -151,6 +151,8 @@ - [Dependency Track](https://dependencytrack.org/), an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Available as [services.dependency-track](option.html#opt-services.dependency-track). +- [Immich](https://github.com/immich-app/immich), a self-hosted photo and video backup solution. Available as [services.immich](#opt-services.immich.enable). + ## Backward Incompatibilities {#sec-release-24.11-incompatibilities} - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage: diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 4a97be04fe7f..68cd01c3c6f4 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1430,6 +1430,7 @@ ./services/web-apps/icingaweb2/icingaweb2.nix ./services/web-apps/icingaweb2/module-monitoring.nix ./services/web-apps/ifm.nix + ./services/web-apps/immich.nix ./services/web-apps/invidious.nix ./services/web-apps/invoiceplane.nix ./services/web-apps/isso.nix diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix new file mode 100644 index 000000000000..1e46f3b855df --- /dev/null +++ b/nixos/modules/services/web-apps/immich.nix @@ -0,0 +1,311 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.services.immich; + isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host; + isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host; + + commonServiceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 3; + + # Hardening + CapabilityBoundingSet = ""; + NoNewPrivileges = true; + PrivateUsers = true; + PrivateTmp = true; + PrivateDevices = true; + PrivateMounts = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + }; + inherit (lib) + types + mkIf + mkOption + mkEnableOption + ; +in +{ + options.services.immich = { + enable = mkEnableOption "Immich"; + package = lib.mkPackageOption pkgs "immich" { }; + + mediaLocation = mkOption { + type = types.path; + default = "/var/lib/immich"; + description = "Directory used to store media files. If it is not the default, the directory has to be created manually such that the immich user is able to read and write to it."; + }; + environment = mkOption { + type = types.submodule { freeformType = types.attrsOf types.str; }; + default = { }; + example = { + IMMICH_LOG_LEVEL = "verbose"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options tagged with 'server', 'api' or 'microservices'. + ''; + }; + secretsFile = mkOption { + type = types.nullOr ( + types.str + // { + # We don't want users to be able to pass a path literal here but + # it should look like a path. + check = it: lib.isString it && lib.types.path.check it; + } + ); + default = null; + example = "/run/secrets/immich"; + description = '' + Path of a file with extra environment variables to be loaded from disk. This file is not added to the nix store, so it can be used to pass secrets to immich. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options. + + To set a database password set this to a file containing: + ``` + DB_PASSWORD= + ``` + ''; + }; + host = mkOption { + type = types.str; + default = "localhost"; + description = "The host that immich will listen on."; + }; + port = mkOption { + type = types.port; + default = 3001; + description = "The port that immich will listen on."; + }; + openFirewall = mkOption { + type = types.bool; + default = false; + description = "Whether to open the immich port in the firewall"; + }; + user = mkOption { + type = types.str; + default = "immich"; + description = "The user immich should run as."; + }; + group = mkOption { + type = types.str; + default = "immich"; + description = "The group immich should run as."; + }; + + machine-learning = { + enable = + mkEnableOption "immich's machine-learning functionality to detect faces and search for objects" + // { + default = true; + }; + environment = mkOption { + type = types.submodule { freeformType = types.attrsOf types.str; }; + default = { }; + example = { + MACHINE_LEARNING_MODEL_TTL = "600"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://immich.app/docs/install/environment-variables) for options tagged with 'machine-learning'. + ''; + }; + }; + + database = { + enable = + mkEnableOption "the postgresql database for use with immich. See {option}`services.postgresql`" + // { + default = true; + }; + createDB = mkEnableOption "the automatic creation of the database for immich." // { + default = true; + }; + name = mkOption { + type = types.str; + default = "immich"; + description = "The name of the immich database."; + }; + host = mkOption { + type = types.str; + default = "/run/postgresql"; + example = "127.0.0.1"; + description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path."; + }; + user = mkOption { + type = types.str; + default = "immich"; + description = "The database user for immich."; + }; + }; + redis = { + enable = mkEnableOption "a redis cache for use with immich" // { + default = true; + }; + host = mkOption { + type = types.str; + default = config.services.redis.servers.immich.unixSocket; + defaultText = lib.literalExpression "config.services.redis.servers.immich.unixSocket"; + description = "The host that redis will listen on."; + }; + port = mkOption { + type = types.port; + default = 0; + description = "The port that redis will listen on. Set to zero to disable TCP."; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = !isPostgresUnixSocket -> cfg.secretsFile != null; + message = "A secrets file containing at least the database password must be provided when unix sockets are not used."; + } + ]; + + services.postgresql = mkIf cfg.database.enable { + enable = true; + ensureDatabases = mkIf cfg.database.createDB [ cfg.database.name ]; + ensureUsers = mkIf cfg.database.createDB [ + { + name = cfg.database.user; + ensureDBOwnership = true; + ensureClauses.login = true; + } + ]; + extraPlugins = ps: with ps; [ pgvecto-rs ]; + settings = { + shared_preload_libraries = [ "vectors.so" ]; + search_path = "\"$user\", public, vectors"; + }; + }; + systemd.services.postgresql.serviceConfig.ExecStartPost = + let + sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" '' + CREATE EXTENSION IF NOT EXISTS unaccent; + CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; + CREATE EXTENSION IF NOT EXISTS vectors; + CREATE EXTENSION IF NOT EXISTS cube; + CREATE EXTENSION IF NOT EXISTS earthdistance; + CREATE EXTENSION IF NOT EXISTS pg_trgm; + + ALTER SCHEMA public OWNER TO ${cfg.database.user}; + ALTER SCHEMA vectors OWNER TO ${cfg.database.user}; + GRANT SELECT ON TABLE pg_vector_index_stat TO ${cfg.database.user}; + + ALTER EXTENSION vectors UPDATE; + ''; + in + [ + '' + ${lib.getExe' config.services.postgresql.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}" + '' + ]; + + services.redis.servers = mkIf cfg.redis.enable { + immich = { + enable = true; + user = cfg.user; + port = cfg.redis.port; + bind = mkIf (!isRedisUnixSocket) cfg.redis.host; + }; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; + + services.immich.environment = + let + postgresEnv = + if isPostgresUnixSocket then + { DB_URL = "socket://${cfg.database.host}?dbname=${cfg.database.name}"; } + else + { + DB_HOSTNAME = cfg.database.host; + DB_PORT = toString cfg.database.port; + DB_DATABASE_NAME = cfg.database.name; + DB_USERNAME = cfg.database.user; + }; + redisEnv = + if isRedisUnixSocket then + { REDIS_SOCKET = cfg.redis.host; } + else + { + REDIS_PORT = toString cfg.redis.port; + REDIS_HOSTNAME = cfg.redis.host; + }; + in + postgresEnv + // redisEnv + // { + HOST = cfg.host; + IMMICH_PORT = toString cfg.port; + IMMICH_MEDIA_LOCATION = cfg.mediaLocation; + IMMICH_MACHINE_LEARNING_URL = "http://localhost:3003"; + }; + + services.immich.machine-learning.environment = { + MACHINE_LEARNING_WORKERS = "1"; + MACHINE_LEARNING_WORKER_TIMEOUT = "120"; + MACHINE_LEARNING_CACHE_FOLDER = "/var/cache/immich"; + IMMICH_HOST = "localhost"; + IMMICH_PORT = "3003"; + }; + + systemd.services.immich-server = { + description = "Immich backend server (Self-hosted photo and video backup solution)"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg) environment; + + serviceConfig = commonServiceConfig // { + ExecStart = lib.getExe cfg.package; + EnvironmentFile = mkIf (cfg.secretsFile != null) cfg.secretsFile; + StateDirectory = "immich"; + RuntimeDirectory = "immich"; + User = cfg.user; + Group = cfg.group; + }; + }; + + systemd.services.immich-machine-learning = mkIf cfg.machine-learning.enable { + description = "immich machine learning"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg.machine-learning) environment; + serviceConfig = commonServiceConfig // { + ExecStart = lib.getExe cfg.package.machine-learning; + CacheDirectory = "immich"; + User = cfg.user; + Group = cfg.group; + }; + }; + + users.users = mkIf (cfg.user == "immich") { + immich = { + name = "immich"; + group = cfg.group; + isSystemUser = true; + }; + }; + users.groups = mkIf (cfg.group == "immich") { immich = { }; }; + + meta.maintainers = with lib.maintainers; [ jvanbruegge ]; + }; +} From 9d834dc4ecd42965a4357a96813780f587664d56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Tue, 2 Jul 2024 20:18:19 +0100 Subject: [PATCH 4/4] nixos/tests/immich: init tests --- nixos/tests/all-tests.nix | 1 + nixos/tests/web-apps/immich.nix | 51 +++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 nixos/tests/web-apps/immich.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index a625cd92e236..2917a8ed4887 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -455,6 +455,7 @@ in { icingaweb2 = handleTest ./icingaweb2.nix {}; ifm = handleTest ./ifm.nix {}; iftop = handleTest ./iftop.nix {}; + immich = handleTest ./web-apps/immich.nix {}; incron = handleTest ./incron.nix {}; incus = pkgs.recurseIntoAttrs (handleTest ./incus { inherit handleTestOn; inherit (pkgs) incus; }); incus-lts = pkgs.recurseIntoAttrs (handleTest ./incus { inherit handleTestOn; }); diff --git a/nixos/tests/web-apps/immich.nix b/nixos/tests/web-apps/immich.nix new file mode 100644 index 000000000000..f03b9290f7a5 --- /dev/null +++ b/nixos/tests/web-apps/immich.nix @@ -0,0 +1,51 @@ +import ../make-test-python.nix ( + { ... }: + { + name = "immich-nixos"; + + nodes.machine = + { pkgs, ... }: + { + # These tests need a little more juice + virtualisation = { + cores = 2; + memorySize = 2048; + diskSize = 4096; + }; + + environment.systemPackages = with pkgs; [ immich-cli ]; + + services.immich = { + enable = true; + environment.IMMICH_LOG_LEVEL = "verbose"; + }; + }; + + testScript = '' + import json + + machine.wait_for_unit("immich-server.service") + + machine.wait_for_open_port(3001) # Server + machine.wait_for_open_port(3003) # Machine learning + machine.succeed("curl --fail http://localhost:3001/") + + machine.succeed(""" + curl -H 'Content-Type: application/json' --data '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' -X POST http://localhost:3001/api/auth/admin-sign-up + """) + res = machine.succeed(""" + curl -H 'Content-Type: application/json' --data '{ "email": "test@example.com", "password": "admin" }' -X POST http://localhost:3001/api/auth/login + """) + token = json.loads(res)['accessToken'] + + res = machine.succeed(""" + curl -H 'Content-Type: application/json' -H 'Cookie: immich_access_token=%s' --data '{ "name": "API Key", "permissions": ["all"] }' -X POST http://localhost:3001/api/api-keys + """ % token) + key = json.loads(res)['secret'] + + machine.succeed(f"immich login http://localhost:3001/api {key}") + res = machine.succeed("immich server-info") + print(res) + ''; + } +)