xin/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

modules: clean up

Browse source
This commit is contained in:
xinyangli 2024-12-04 19:15:19 +08:00
parent 241f7265d5
commit 7bc5db676d
Signed by: xin
SSH key fingerprint: SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
9 changed files with 108 additions and 129 deletions
Download patch file Download diff file Expand all files Collapse all files

2
machines/biotite/services/forgejo.nix
View file

@ -38,7 +38,7 @@ let
OPENID_CONNECT_SCOPES = "openid profile email groups";
};
metrics = {
ENABLED = true;
# ENABLED = true;
};
other = {
SHOW_FOOTER_VERSION = false;

20
machines/calcite/configuration.nix
View file

@ -334,16 +334,16 @@ in
];
};
custom.forgejo-actions-runner = {
enable = false;
tokenFile = config.sops.secrets."gitea/envfile".path;
settings = {
runner.capacity = 2;
runner.fetch_timeout = "120s";
runner.fetch_interval = "30s";
};
};
# custom.forgejo-actions-runner = {
# enable = false;
# tokenFile = config.sops.secrets."gitea/envfile".path;
# settings = {
# runner.capacity = 2;
# runner.fetch_timeout = "120s";
# runner.fetch_interval = "30s";
# };
# };
#
custom.prometheus = {
exporters.node.enable = true;
};

45
machines/weilite/default.nix
View file

@ -52,10 +52,6 @@
owner = "caddy";
mode = "400";
};
"immich/oauth_client_secret" = {
owner = "immich";
mode = "400";
};
"restic/localpass" = {
owner = "restic";
};
@ -72,6 +68,10 @@
};
};
custom.monitoring = {
loki.enable = true;
};
systemd.mounts = [
{
what = "immich";
@ -108,43 +108,6 @@
2222
];
services.immich = {
enable = true;
mediaLocation = "/mnt/XinPhotos/immich";
host = "127.0.0.1";
port = 3001;
openFirewall = true;
machine-learning.enable = true;
environment = {
IMMICH_MACHINE_LEARNING_ENABLED = "true";
};
database.enable = true;
};
custom.immich.jsonSettings = {
oauth = {
enabled = true;
issuerUrl = "https://auth.xinyang.life/oauth2/openid/immich/";
clientId = "immich";
clientSecret = {
_secret = config.sops.secrets."immich/oauth_client_secret".path;
};
scope = "openid email profile";
signingAlgorithm = "ES256";
storageLabelClaim = "email";
buttonText = "Login with Kanidm";
autoLaunch = true;
mobileOverrideEnabled = true;
mobileRedirectUri = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
};
passwordLogin = {
enabled = false;
};
newVersionCheck = {
enabled = false;
};
};
services.dae = {
enable = true;
configFile = "/var/lib/dae/config.dae";

1
machines/weilite/services/default.nix
View file

@ -3,5 +3,6 @@
./ocis.nix
./restic.nix
./media-download.nix
./immich.nix
];
}

63
machines/weilite/services/immich.nix Normal file
View file

@ -0,0 +1,63 @@
{
config,
...
}:
let
user = config.systemd.services.immich-server.serviceConfig.User;
jsonSettings = {
oauth = {
enabled = true;
issuerUrl = "https://auth.xinyang.life/oauth2/openid/immich/";
clientId = "immich";
clientSecret = config.sops.placeholder."immich/oauth_client_secret";
scope = "openid email profile";
signingAlgorithm = "ES256";
storageLabelClaim = "email";
buttonText = "Login with Kanidm";
autoLaunch = true;
mobileOverrideEnabled = true;
mobileRedirectUri = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
};
passwordLogin = {
enabled = false;
};
image = {
extractEmbedded = true;
};
newVersionCheck = {
enabled = false;
};
};
in
{
config = {
sops.secrets."immich/oauth_client_secret" = { };
sops.templates."immich/config.json" = {
owner = user; # Read when running
content = builtins.toJSON jsonSettings;
};
systemd.services.immich-server = {
serviceConfig = {
Environment = "IMMICH_CONFIG_FILE=${config.sops.templates."immich/config.json".path}";
};
};
services.immich = {
enable = true;
mediaLocation = "/mnt/XinPhotos/immich";
host = "127.0.0.1";
port = 3001;
openFirewall = true;
machine-learning.enable = true;
environment = {
IMMICH_MACHINE_LEARNING_ENABLED = "true";
};
database.enable = true;
};
# https://github.com/NixOS/nixpkgs/pull/324127/files#r1723763510
services.immich.redis.host = "/run/redis-immich/redis.sock";
};
}