refactor: split server modules into smaller more manageable files

modules/nixos-modules/server/immich/database.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  ...
+}: {
+  config = lib.mkIf config.services.immich.enable (lib.mkMerge [
+    {
+      host = {
+        postgres = {
+          enable = true;
+        };
+      };
+    }
+    (lib.mkIf config.host.postgres.enable {
+      host = {
+        postgres = {
+          extraUsers = {
+            ${config.services.immich.database.user} = {
+              isClient = true;
+            };
+          };
+        };
+      };
+    })
+  ]);
+}

modules/nixos-modules/server/immich/default.nix

@@ -0,0 +1,28 @@
+{lib, ...}: {
+  imports = [
+    ./proxy.nix
+    ./database.nix
+    ./fail2ban.nix
+    ./impermanence.nix
+  ];
+
+  options.services.immich = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that immich will be hosted at";
+      default = "immich";
+    };
+  };
+
+  # NOTE: This shouldn't be needed now that we are out of testing
+  # config = lib.mkIf config.services.immich.enable {
+  #   networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {
+  #     allowedUDPPorts = [
+  #       config.services.immich.port
+  #     ];
+  #     allowedTCPPorts = [
+  #       config.services.immich.port
+  #     ];
+  #   };
+  # };
+}

modules/nixos-modules/server/immich/fail2ban.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  config = lib.mkIf (config.services.fail2ban.enable && config.services.immich.enable) {
+    environment.etc = {
+      "fail2ban/filter.d/immich.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+        [Definition]
+        failregex = immich-server.*Failed login attempt for user.+from ip address\s?<ADDR>
+        journalmatch = CONTAINER_TAG=immich-server
+      '');
+    };
+
+    services.fail2ban = {
+      jails = {
+        immich-iptables.settings = {
+          enabled = true;
+          filter = "immich";
+          backend = "systemd";
+        };
+      };
+    };
+  };
+}

modules/nixos-modules/server/immich/impermanence.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  mediaLocation = "/var/lib/immich";
+in {
+  config = lib.mkIf (config.services.immich.enable && config.host.impermanence.enable) {
+    assertions = [
+      {
+        assertion = config.services.immich.mediaLocation == mediaLocation;
+        message = "immich media location does not match persistence";
+      }
+    ];
+    environment.persistence."/persist/system/root" = {
+      directories = [
+        {
+          directory = mediaLocation;
+          user = "immich";
+          group = "immich";
+        }
+      ];
+    };
+  };
+}

modules/nixos-modules/server/immich/proxy.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  ...
+}: {
+  config = lib.mkIf (config.services.immich.enable && config.host.reverse_proxy.enable) {
+    host = {
+      reverse_proxy.subdomains.${config.services.immich.subdomain} = {
+        target = "http://localhost:${toString config.services.immich.port}";
+
+        websockets.enable = true;
+        forwardHeaders.enable = true;
+
+        extraConfig = ''
+          # allow large file uploads
+          client_max_body_size 50000M;
+
+          # set timeout
+          proxy_read_timeout 600s;
+          proxy_send_timeout 600s;
+          send_timeout       600s;
+          proxy_redirect     off;
+        '';
+      };
+    };
+  };
+}