weilite/webdav: init

machines/weilite/default.nix

@@ -102,6 +102,13 @@
         type = "virtiofs";
         options = "rw,nodev,nosuid";
       }
+{
+        what = "originals";
+        where = "/mnt/photos/xin/originals";
+        type = "virtiofs";
+        options = "rw,nodev,nosuid";
+        wantedBy = [ "immich-server.service" ];
+      }
       {
         what = "/mnt/nixos/ocis";
         where = "/var/lib/ocis";

machines/weilite/services/default.nix

@@ -7,5 +7,6 @@
     ./immich.nix
     ./jellyfin.nix
     ./transmission.nix
+    ./webdav.nix
   ];
 }

machines/weilite/services/immich.nix

@@ -86,16 +86,6 @@ in
       '';
     };
 
-    systemd.mounts = [
-      {
-        what = "originals";
-        where = "/mnt/immich/external-library/xin";
-        type = "virtiofs";
-        options = "ro,nodev,nosuid";
-        wantedBy = [ "immich-server.service" ];
-      }
-    ];
-
     systemd.timers.immich-auto-stack = {
       enable = true;
       wantedBy = [ "immich-server.service" ];
@@ -135,8 +125,8 @@ in
 
     systemd.services.immich-server = {
       serviceConfig = {
-        ReadWritePaths = [
-          "/mnt/immich/external-library/xin"
+        BindReadOnlyPaths = [
+          "/mnt/photos/xin/originals:/mnt/immich/external-library/xin"
         ];
         Environment = "IMMICH_CONFIG_FILE=${config.sops.templates."immich/config.json".path}";
       };

machines/weilite/services/webdav.nix

@@ -0,0 +1,37 @@
+{ config, ... }:
+{
+
+  sops.secrets = {
+    "webdav/photosync/password" = { };
+  };
+
+  sops.templates."webdav.env" = {
+    content = ''
+      PHOTOSYNC_PASSWORD=${config.sops.placeholder."webdav/photosync/password"}
+    '';
+  };
+
+  services.webdav = {
+    enable = true;
+    settings = {
+      permissions = "RC";
+      behindProxy = true;
+      users = [
+        {
+          username = "photosync";
+          password = "{ENV}PHOTOSYNC_PASSWORD";
+        }
+      ];
+    };
+    environmentFile = config.sops.templates."webdav.env".path;
+  };
+
+  systemd.services.webdav.serviceConfig = {
+    BindReadOnlyPaths = [
+      "/mnt/photos/xin/originals:%t/webdav/photosync"
+    ];
+    RuntimeDirectory = "webdav";
+    WorkingDirectory = "%t/webdav";
+  };
+
+}