merge: merged leyla/main

modules/nixos-modules/server/immich/database.nix

@@ -3,24 +3,28 @@
   config,
   ...
 }: {
-  config = lib.mkIf config.services.immich.enable (lib.mkMerge [
-    {
-      host = {
-        postgres = {
-          enable = true;
-        };
-      };
-    }
-    (lib.mkIf config.host.postgres.enable {
-      host = {
-        postgres = {
-          extraUsers = {
-            ${config.services.immich.database.user} = {
-              isClient = true;
-            };
-          };
-        };
-      };
-    })
-  ]);
+  config = lib.mkIf config.services.immich.enable {
+    assertions = [
+      {
+        assertion = !config.services.immich.database.enable || config.services.postgresql.enable;
+        message = "PostgreSQL must be enabled when using postgres database for Immich";
+      }
+      {
+        assertion = !(config.services.immich.database.enable && config.services.immich.database.createDB) || (builtins.any (db: db == "immich") config.services.postgresql.ensureDatabases);
+        message = "Immich built-in database creation failed - expected 'immich' in ensureDatabases but got: ${builtins.toString config.services.postgresql.ensureDatabases}";
+      }
+      {
+        assertion = !(config.services.immich.database.enable && config.services.immich.database.createDB) || (builtins.any (user: user.name == "immich") config.services.postgresql.ensureUsers);
+        message = "Immich built-in user creation failed - expected user 'immich' in ensureUsers but got: ${builtins.toString (builtins.map (u: u.name) config.services.postgresql.ensureUsers)}";
+      }
+    ];
+
+    # Note: Immich has built-in database creation via services.immich.database.createDB we only add the systemd dependency
+
+    systemd.services.immich-server = lib.mkIf config.services.immich.database.enable {
+      requires = [
+        config.systemd.services.postgresql.name
+      ];
+    };
+  };
 }

modules/nixos-modules/server/immich/fail2ban.nix

@@ -4,7 +4,16 @@
   pkgs,
   ...
 }: {
-  config = lib.mkIf (config.services.fail2ban.enable && config.services.immich.enable) {
+  options.services.immich = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.fail2ban.enable && config.services.immich.enable;
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.immich.fail2ban.enable {
     environment.etc = {
       "fail2ban/filter.d/immich.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
         [Definition]

modules/nixos-modules/server/immich/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   mediaLocation = "/var/lib/immich";
 in {
-  config = lib.mkIf (config.services.immich.enable && config.host.impermanence.enable) {
+  options.services.immich = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.immich.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.immich.impermanence.enable {
     assertions = [
       {
         assertion = config.services.immich.mediaLocation == mediaLocation;

modules/nixos-modules/server/immich/proxy.nix

@@ -4,31 +4,40 @@
   ...
 }: {
   options.services.immich = {
-    subdomain = lib.mkOption {
+    domain = lib.mkOption {
       type = lib.types.str;
-      description = "subdomain of base domain that immich will be hosted at";
-      default = "immich";
+      description = "domain that immich will be hosted at";
+      default = "immich.arpa";
+    };
+    extraDomains = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "extra domains that should be configured for immich";
+      default = [];
+    };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.immich.enable && config.services.reverseProxy.enable;
+      };
     };
   };
 
-  config = lib.mkIf (config.services.immich.enable && config.host.reverse_proxy.enable) {
-    host = {
-      reverse_proxy.subdomains.${config.services.immich.subdomain} = {
-        target = "http://localhost:${toString config.services.immich.port}";
+  config = lib.mkIf config.services.immich.reverseProxy.enable {
+    services.reverseProxy.services.immich = {
+      target = "http://localhost:${toString config.services.immich.port}";
+      domain = config.services.immich.domain;
+      extraDomains = config.services.immich.extraDomains;
 
-        websockets.enable = true;
+      settings = {
+        proxyWebsockets.enable = true;
         forwardHeaders.enable = true;
+        maxBodySize = 50000;
 
-        extraConfig = ''
-          # allow large file uploads
-          client_max_body_size 50000M;
-
-          # set timeout
-          proxy_read_timeout 600s;
-          proxy_send_timeout 600s;
-          send_timeout       600s;
-          proxy_redirect     off;
-        '';
+        # Custom timeout settings
+        proxyHeaders = {
+          enable = true;
+          timeout = 600;
+        };
       };
     };
   };