🏡 my personal home lab
add immich
+40
-3
+1
hosts/rk1-node-2.nix
+1
hosts/rk1-node-2.nix
+3
modules/caddy.nix
+3
modules/caddy.nix
···
54
54
"kitchen.goo.garden".extraConfig = ''
55
55
reverse_proxy rk1-node-2:9080
56
56
'';
57
+
"photos.goo.garden".extraConfig = ''
58
+
reverse_proxy rk1-node-2:2283
59
+
'';
57
60
"probe.outerwilds.space".extraConfig = ''
58
61
reverse_proxy localhost:${config.services.uptime-kuma.settings.PORT}
59
62
'';
+31
modules/immich.nix
+31
modules/immich.nix
···
1
+
{ config, ... }:
2
+
{
3
+
services.immich = {
4
+
enable = true;
5
+
openFirewall = true;
6
+
host = "0.0.0.0";
7
+
mediaLocation = "/mnt/nas/data/immich";
8
+
secretsFile = config.sops.templates."immich.env".path;
9
+
settings = {
10
+
oauth = {
11
+
enabled = true;
12
+
autoRegister = true;
13
+
issuerUrl = "https://id.goo.garden";
14
+
clientId = "immich";
15
+
clientSecret._secret = config.sops.secrets.immich-oidc-client-secret.path;
16
+
buttonText = "Sign in with gooID";
17
+
};
18
+
};
19
+
};
20
+
21
+
systemd.services.immich-server = {
22
+
after = [ "mnt-nas.mount" ];
23
+
requires = [ "mnt-nas.mount" ];
24
+
};
25
+
26
+
sops.templates."immich.env".content = ''
27
+
DB_PASSWORD=${config.sops.placeholder.immich-db-password}
28
+
'';
29
+
sops.secrets.immich-db-password = { };
30
+
sops.secrets.immich-oidc-client-secret = { };
31
+
}
+5
-3
secrets/secrets.yaml
+5
-3
secrets/secrets.yaml
···
10
10
kitchenowl-db-password: ENC[AES256_GCM,data:dLbd7ikyUqudXHpdohzwoSGdR4XwrDJpiV5Zxvfvm+kyDgLyoNFeIR2riMxAwSXgoOwNxpsNe9Zhtm6sdsVwTg==,iv:KlVfJwJDGxqzCq3e+208vhtTxA736s6mbweF9Dbjzq8=,tag:AvDPlFZk+7UpeuIL0RAhEA==,type:str]
11
11
kitchenowl-oidc-client-id: ENC[AES256_GCM,data:ifQHYZP6Z3H1SQkQ8XRaZ//GuWf6Jn98+q3nXs7QXGu8QywO,iv:1jfTO846YR57WwCGhVEoxHQZr2W92Z7pWDYPceHDMYo=,tag:BOf81pF/tWDE2Z7/tTHV0g==,type:str]
12
12
kitchenowl-oidc-client-secret: ENC[AES256_GCM,data:rAaxP7OZoQ/soElu10BYnI7L1Fze3AwXkZE1geZ87jE=,iv:nZpHxJZPRndNpAJVrB6YsKPS1SgovfcFIZ9XtP+8dEY=,tag:N6ew5wyFhZChIf5yBV/bVQ==,type:str]
13
+
immich-db-password: ENC[AES256_GCM,data:fnhbOlPlidS0mPV/ehJbauutyDgzycTseHNfR33/MUQl6bE8bZ8aWRpRbqHtUy1UfxjJfoeJF5C+IcJTGYXRdA==,iv:faUyWBEy73G5GOrtI+NUODLzyV10ISOIZ+JJLGPv8zA=,tag:jqhVAo+JYYuFdqi7Zpn89A==,type:str]
14
+
immich-oidc-client-secret: ENC[AES256_GCM,data:5HyB9XWsN6QLdWvnxfNI2WO5snbj4oRl78fW++R40Zk=,iv:5Oo46wCTkFCy4859rLLCISgC77dv0beEhTQ8s2gUmKA=,tag:X7qULtRuSFhCutb67Z+fgg==,type:str]
13
15
backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str]
14
16
backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str]
15
17
sops:
···
59
61
ajA5bDZCY1BnblVYRGQ1QTE2S2I4M2cKSIGmFBP6sqiiM+cvTMQuZHit9fN5Vffk
60
62
1pWz8xSen/tqoywqipRf3LqzFb2K7Bx15vwazHbm6LJJa+ZQaruVMg==
61
63
-----END AGE ENCRYPTED FILE-----
62
-
lastmodified: "2026-03-23T23:11:06Z"
63
-
mac: ENC[AES256_GCM,data:7nZnj5jAqzpqrXWql5cZtfLZBfv/mGE2+PoimeRp/lPtG8StD2FkCFNfaeIjCEMc7IfiWdowGVYCRWGh+d0OsbD/u8pwHBkQd+DwcJocIn9EvYzOMnN/1F5R9yXHTWwrVC0KjM6XIwZ9q+M7WfZhTzEEDyCe+HVqDcg6sgtZvKs=,iv:JNHRrrNxSQItxFWVnEWf3vGFlq3uiFdaHgGWdEIVJI0=,tag:fAsEIj4Cd/t3C6gx+SQurQ==,type:str]
64
+
lastmodified: "2026-03-24T10:27:04Z"
65
+
mac: ENC[AES256_GCM,data:2hUNdVeqyR1pZ9lHdegPT6BlNMDJkh+egV2BHD4WlqIYnlOiExO+hN0eFt/yFGpEp0+HKuc7EBpizTInhA8Fyp/PlLW3f2mMex9LLUAiWnwAJkjJSeB78QDfy8DRqNmkAPRBAYhixF1iukHcG6Svh3mF2IHCnwgWd/O7ysWmeyg=,iv:pTBopn+EKULEieYxI2aNWyhCbQyCrUi9XMqDxrtdjq0=,tag:KFTUoR8GIY9FcX7LQa2szw==,type:str]
64
66
unencrypted_suffix: _unencrypted
65
-
version: 3.12.1
67
+
version: 3.12.2