From d650b72c0f71142426106db4dd71b2e7c7c413a5 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Fri, 3 Jan 2025 17:29:55 +0100 Subject: immich --- hosts/surtr/default.nix | 2 +- hosts/surtr/dns/default.nix | 2 +- hosts/surtr/dns/keys/immich.yggdrasil.li_acme | 24 ++++++++++ hosts/surtr/dns/zones/li.yggdrasil.soa | 10 +++- hosts/surtr/immich.nix | 66 +++++++++++++++++++++++++++ hosts/surtr/tls/tsig_key.gup | 4 +- hosts/surtr/tls/tsig_keys/immich.yggdrasil.li | 24 ++++++++++ hosts/vidhar/default.nix | 2 +- hosts/vidhar/immich.nix | 10 ++++ hosts/vidhar/network/ruleset.nft | 7 +++ hosts/vidhar/postgresql.nix | 32 +++++++++++++ hosts/vidhar/zfs.nix | 2 +- overlays/prometheus-lvm-exporter.nix | 2 +- 13 files changed, 179 insertions(+), 8 deletions(-) create mode 100644 hosts/surtr/dns/keys/immich.yggdrasil.li_acme create mode 100644 hosts/surtr/immich.nix create mode 100644 hosts/surtr/tls/tsig_keys/immich.yggdrasil.li create mode 100644 hosts/vidhar/immich.nix create mode 100644 hosts/vidhar/postgresql.nix diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix index 223e1f10..b8a639d5 100644 --- a/hosts/surtr/default.nix +++ b/hosts/surtr/default.nix @@ -6,7 +6,7 @@ with lib; imports = with flake.nixosModules.systemProfiles; [ tmpfs-root qemu-guest openssh rebuild-machines zfs ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql - ./prometheus ./email ./vpn ./borg.nix ./etebase + ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix ]; config = { diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix index 53df798e..ee1d089d 100644 --- a/hosts/surtr/dns/default.nix +++ b/hosts/surtr/dns/default.nix @@ -157,7 +157,7 @@ in { ${concatMapStringsSep "\n" mkZone [ { domain = "yggdrasil.li"; addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; }; - acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "app.etesync.yggdrasil.li"]; + acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li"]; } { domain = "nights.email"; addACLs = { "nights.email" = ["ymir_acme_acl"]; }; diff --git a/hosts/surtr/dns/keys/immich.yggdrasil.li_acme b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme new file mode 100644 index 00000000..c31234bd --- /dev/null +++ b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:1i27jx1E4nn8/iXEN90tnQve0MX0HcXyYZoQfga1djcESDARd7kX78jncqnSdEMJPIQCyq2zmvOwEiAwyofIjSBSW2teoxD1PybSZdyvKwOnwLqpVWxgw6LORUoN5c1y4+WmnQa1SJ0a1WJwZ3cFRa3LP5JPbZzmNCZWEg+yGwVHNMsmrBSrjLRFC1NPIfX69lWGZl5VIMw2/SoSMDcOsSURWIpVSEYe9LNrc4/cKQQC/rmpXBg9ekIa8xd7NQTcDZA42bDIBQxJzqkUNV3JeIrl0C+eQw==,iv:MEDhvUvy0PfcLGim06VXkiIGgkNgaQcYqGhJraaGC6M=,tag:43CdGFe5JXOsMCHrvgl+BA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLOU5OL0xxVVE2dzVOYnhP\nMUlhYlpyZGZSamU4QkpObHJLS1NJdjdwcmtjCks0OElnaHZvb3BSNnYySnVPcEUx\nazdNVUpZZGRNOVNBVTVUNUdnaC9DM00KLS0tIHUxU2dHMCt4d3hJbXlSNzBKUk1W\na05uZVRwVlMrbEZ2WEkvUy9PUVhmWXcKemRLnCC2mAkCEbZ3bC+iZmIWQCQsI+ew\ni4mmc/mUkGx8/61SR571NXIKmxSx2U5L2IK1pIKy6G/xMkPq+wDgUQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VnNUV2lRR292ZmpNeU51\nQ2YxcnVnd21ybGdpd0I1QlJuSEQwNGZYTDJrCml0YUdxaWJHTEFNYWVIY01jWGk2\nZEJSQ0VZcVV1bU9VZ3dBbUh3a0N1ekUKLS0tIFhvNnRqcnRUZFNYOVhuWkFrZ3Vk\nMjU0YnNDODJRYk9lVENLUU9KU2dkWm8KHqtuNtC39S4oiQFRhNT2OOUOY9KQvDYW\nvtcdR8MSZDE7jsqgLgGS/8lIc0GBbIwYWghgFsLmn2Bkdh2q/VuO9w==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-01-03T15:31:39Z", + "mac": "ENC[AES256_GCM,data:NKUbtcQf2DfALfm9kwiirmwD3slfTh4HNIg8BT/xbySHfwsaFtmlZTkhavBNr+b5snR8opATVXnJPAoykxXq8q4G1yDeitnTw6x9KfwgyZKpbJANMTBZEwK+CnZbqYRas1bFC88+D0yWI1yUnle+NPQ8VUj+KxCiUNuWO80mWhE=,iv:2a7CawUQujcZuR1pmsm9L2KGKcrBRAOxiIWEKCkTCEM=,tag:j8caxyN2fvx2FnWXHkWKcw==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.2" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa index 092d23ec..9af6232f 100644 --- a/hosts/surtr/dns/zones/li.yggdrasil.soa +++ b/hosts/surtr/dns/zones/li.yggdrasil.soa @@ -1,7 +1,7 @@ $ORIGIN yggdrasil.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li ( - 2024102100 ; serial + 2025010300 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -69,6 +69,14 @@ _acme-challenge.app.etesync IN NS ns.yggdrasil.li. app.etesync IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" +immich IN A 202.61.241.61 +immich IN AAAA 2a03:4000:52:ada:: +immich IN MX 0 surtr.yggdrasil.li +immich IN TXT "v=spf1 redirect=surtr.yggdrasil.li" +_acme-challenge.immich IN NS ns.yggdrasil.li. + +immich IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" + vidhar IN AAAA 2a03:4000:52:ada:4:1:: vidhar IN MX 0 ymir.yggdrasil.li vidhar IN TXT "v=spf1 redirect=yggdrasil.li" diff --git a/hosts/surtr/immich.nix b/hosts/surtr/immich.nix new file mode 100644 index 00000000..61a55e77 --- /dev/null +++ b/hosts/surtr/immich.nix @@ -0,0 +1,66 @@ +{ config, ... }: + +{ + config = { + security.acme.rfc2136Domains = { + "immich.yggdrasil.li" = { + restartUnits = ["nginx.service"]; + }; + }; + + services.nginx = { + upstreams."immich" = { + servers = { + "[2a03:4000:52:ada:4:1::]:2283" = {}; + }; + extraConfig = '' + keepalive 8; + ''; + }; + virtualHosts = { + "immich.yggdrasil.li" = { + kTLS = true; + http3 = true; + forceSSL = true; + sslCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.pem"; + sslCertificateKey = "/run/credentials/nginx.service/immich.yggdrasil.li.key.pem"; + sslTrustedCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.chain.pem"; + extraConfig = '' + charset utf-8; + ''; + + locations = { + "/".extraConfig = '' + proxy_pass http://immich; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_redirect off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Proto $scheme; + + client_max_body_size 0; + proxy_request_buffering off; + proxy_buffering off; + ''; + }; + }; + }; + }; + + systemd.services.nginx = { + serviceConfig = { + LoadCredential = [ + "immich.yggdrasil.li.key.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/key.pem" + "immich.yggdrasil.li.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/fullchain.pem" + "immich.yggdrasil.li.chain.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/chain.pem" + ]; + }; + }; + }; +} diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup index 3d81b603..825479e5 100644 --- a/hosts/surtr/tls/tsig_key.gup +++ b/hosts/surtr/tls/tsig_key.gup @@ -1,6 +1,6 @@ #!/usr/bin/env zsh -keyFile=../dns/keys/${2:t}_acme.yaml +keyFile=../dns/keys/${2:t}_acme gup -u $keyFile sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1 -sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1 \ No newline at end of file +sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1 diff --git a/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li new file mode 100644 index 00000000..73104cc1 --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:COfmT91I4+yiPhN3Hi7BTqMHyKhdKtwlzT9vNgTZc7FWTHhfuTtCHQo/rhX0,iv:RDs//AT8peUhKwIRdchCScUr/PlEzyMzQPB90S4k3g4=,tag:Lh4BULmQ6+hC+Ed8s9k0Hw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVEQvU29uWnVjMS8xcGp1\nam5hZVN3ejAxaGdpVWNia0VxT0I3dzR4YlV3ClczOGd0ZDJmUDhqb2dEdm5VeUdX\nRlR1WDNYUU9qaTYrRzhYMXBTV1JjV1UKLS0tIHBONU55RWtRSkR6K2NTNFZrUEZj\nbktqY0xBdGtiZWFFV3JUUVZTOC9YV2MKI4Ytz1NZ9+Og0GzIt/bh6L3aJUeR476g\nyRNifW4eOHf4Ne02ElpEoq6woInkxk8Ou/SJVIRmEOhjwm+qbV17gQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVOVNydWcyYjFrZDR2WStu\nWkJQd3VTTGtqVzdLVFR1eFdPZXBtVFBzVXc4ClREQVpKeXlhWlBFQzVFL0VGME5K\nUUhoa3A1YWdvSkZVV1FQcUh5L3RoUmMKLS0tIHE4c3A1OTNXVk9xZHJPZTlSMlQ4\nZnZUTXdjUGZuN3NoSEFSSko1aU5aQUEKHcuI2+9q7DsDwRn7mfwcSyC7AixzCC0e\nhqnGaW0HxmtLeOFuSPLdFMhhockCYGEV/907i/X6EImepWC4cf3bqA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-01-03T15:31:40Z", + "mac": "ENC[AES256_GCM,data:soDFDk35A1ULzOosZNrbhvtG3NPJDpAtLP3xrDtCBxgSGQ0lWrQ0o3MaKaJoDXQv7g/vYghmSwjH+0In0Ib3OWg0WLAlhwTEsiAn1o4JNRu/wF5aqvazOiDzFu7cyWil4Lsphy5eZgtc4IUp75SlCQc71xlNLoxudPpdcSxNLWg=,iv:jBYUZbiWM5gxFA+ZdpxpZIkz3WfgFi59tXFp242/qr8=,tag:H7ihAryZ8be+BbaqXFhRRg==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.2" + } +} \ No newline at end of file diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix index 42a9e80d..d9bc53f2 100644 --- a/hosts/vidhar/default.nix +++ b/hosts/vidhar/default.nix @@ -4,7 +4,7 @@ with lib; { imports = with flake.nixosModules.systemProfiles; [ - ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest + ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix tmpfs-root zfs initrd-all-crypto-modules default-locale openssh rebuild-machines build-server diff --git a/hosts/vidhar/immich.nix b/hosts/vidhar/immich.nix new file mode 100644 index 00000000..a1f145a8 --- /dev/null +++ b/hosts/vidhar/immich.nix @@ -0,0 +1,10 @@ +{ ... }: + +{ + config = { + services.immich = { + enable = true; + host = "2a03:4000:52:ada:4:1::"; + }; + }; +} diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft index 9f519302..10fd4c51 100644 --- a/hosts/vidhar/network/ruleset.nft +++ b/hosts/vidhar/network/ruleset.nft @@ -1,4 +1,5 @@ define icmp_protos = { ipv6-icmp, icmp, igmp } +define bifrost_surtr = 2a03:4000:52:ada:4::/128 table arp filter { limit lim_arp_local { @@ -90,6 +91,7 @@ table inet filter { counter http-rx {} counter tftp-rx {} counter pgbackrest-rx {} + counter immich-rx {} counter established-rx {} @@ -118,6 +120,7 @@ table inet filter { counter http-tx {} counter tftp-tx {} counter pgbackrest-tx {} + counter immich-tx {} counter tx {} @@ -193,6 +196,8 @@ table inet filter { tcp dport 8432 counter name pgbackrest-rx accept + iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept + ct state { established, related } counter name established-rx accept @@ -240,6 +245,8 @@ table inet filter { tcp sport 8432 counter name pgbackrest-tx accept + iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept + counter name tx } diff --git a/hosts/vidhar/postgresql.nix b/hosts/vidhar/postgresql.nix new file mode 100644 index 00000000..fa5b734f --- /dev/null +++ b/hosts/vidhar/postgresql.nix @@ -0,0 +1,32 @@ +{ pkgs, config, flake, flakeInputs, ... }: + +let + nixpkgs-pgbackrest = import (flakeInputs.nixpkgs-pgbackrest.outPath + "/pkgs/top-level") { + overlays = [ flake.overlays.libdscp ]; + localSystem = config.nixpkgs.system; + }; +in { + config = { + services.postgresql = { + enable = true; + package = pkgs.postgresql_15; + }; + + services.pgbackrest = { + settings."vidhar" = { + pg1-path = config.services.postgresql.dataDir; + + repo1-path = "/var/lib/pgbackrest"; + repo1-retention-full-type = "time"; + repo1-retention-full = 14; + repo1-retention-archive = 7; + }; + + backups."vidhar-daily" = { + stanza = "vidhar"; + repo = "1"; + timerConfig.OnCalendar = "daily"; + }; + }; + }; +} diff --git a/hosts/vidhar/zfs.nix b/hosts/vidhar/zfs.nix index 518c3287..9d667fd6 100644 --- a/hosts/vidhar/zfs.nix +++ b/hosts/vidhar/zfs.nix @@ -34,7 +34,7 @@ with lib; }; "/etc/zfs/zfs-list.cache" = - { device = "ssd-raid1/local/zfs-zfs--list.cache"; + { device = "ssd-raid1/local/etc-zfs-zfs--list.cache"; fsType = "zfs"; neededForBoot = true; }; diff --git a/overlays/prometheus-lvm-exporter.nix b/overlays/prometheus-lvm-exporter.nix index 6b671cab..240f8d85 100644 --- a/overlays/prometheus-lvm-exporter.nix +++ b/overlays/prometheus-lvm-exporter.nix @@ -3,7 +3,7 @@ pname = "prometheus-lvm-exporter"; inherit (sources.prometheus-lvm-exporter) version src; - vendorHash = "sha256-vqxsg70ShMo4OVdzhqYDj/HT3RTpCUBGHze/EkbBJig="; + vendorHash = "sha256-z/fV0PzoWSDTJ44En19o7zJPPPox5ymFw7sw0Ab9t00="; doCheck = false; -- cgit v1.2.3