add photoprism
This commit is contained in:
		
							parent
							
								
									1461881cf8
								
							
						
					
					
						commit
						a377eb2f69
					
				|  | @ -222,6 +222,7 @@ | ||||||
|             self.nixosModules.wallabag |             self.nixosModules.wallabag | ||||||
|             self.nixosModules.gonic |             self.nixosModules.gonic | ||||||
|             self.nixosModules.ulogger-server |             self.nixosModules.ulogger-server | ||||||
|  |             self.nixosModules.photoprism | ||||||
|             grasp.nixosModule |             grasp.nixosModule | ||||||
|             home-manager.nixosModules.home-manager |             home-manager.nixosModules.home-manager | ||||||
|             { |             { | ||||||
|  |  | ||||||
							
								
								
									
										51
									
								
								hosts/profiles/photoprism/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										51
									
								
								hosts/profiles/photoprism/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,51 @@ | ||||||
|  | { self, pkgs, config, lib, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   services.postgresql = { | ||||||
|  |     enable = true; | ||||||
|  |     ensureDatabases = [ "photoprism" ]; | ||||||
|  |     ensureUsers = [{ | ||||||
|  |       name = "photoprism"; | ||||||
|  |       ensurePermissions = { | ||||||
|  |         "DATABASE photoprism" = "ALL PRIVILEGES"; | ||||||
|  |       }; | ||||||
|  |     }]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.photoprism = { | ||||||
|  |     enable = true; | ||||||
|  |     port = 2342; | ||||||
|  |     originalsPath = "/var/lib/private/photoprism/originals"; | ||||||
|  |     address = "0.0.0.0"; | ||||||
|  |     settings = { | ||||||
|  |       PHOTOPRISM_ADMIN_USER = "admin"; | ||||||
|  |       PHOTOPRISM_ADMIN_PASSWORD = "..."; | ||||||
|  |       PHOTOPRISM_DEFAULT_LOCALE = "en"; | ||||||
|  |       PHOTOPRISM_DATABASE_DRIVER = "postgres"; | ||||||
|  |       PHOTOPRISM_DATABASE_NAME = "photoprism"; | ||||||
|  |       PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/"; | ||||||
|  |       PHOTOPRISM_DATABASE_USER = "photoprism"; | ||||||
|  |       PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan:2342"; | ||||||
|  |       PHOTOPRISM_SITE_TITLE = "mossnet photos"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.nginx.virtualHosts."photos.mossnet.lan" = { | ||||||
|  |     enableACME = false; | ||||||
|  |     forceSSL = false; | ||||||
|  |     recommendedOptimisation = true; | ||||||
|  |     recommendedGzipSettings = true; | ||||||
|  |     recommendedProxySettings = true; | ||||||
|  |     clientMaxBodySize = "500m"; | ||||||
|  |     locations."/" = { | ||||||
|  |       proxyPass = "http://127.0.0.1:2342"; | ||||||
|  |       extraConfig = '' | ||||||
|  |         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||||
|  |         proxy_buffering off; | ||||||
|  |         proxy_http_version 1.1; | ||||||
|  |         proxy_set_header Upgrade $http_upgrade; | ||||||
|  |         proxy_set_header Connection "upgrade"; | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -10,4 +10,5 @@ | ||||||
|   backup = import ./backup.nix; |   backup = import ./backup.nix; | ||||||
|   ulogger-server = import ./ulogger.nix; |   ulogger-server = import ./ulogger.nix; | ||||||
|   microbin = import ./microbin.nix; |   microbin = import ./microbin.nix; | ||||||
|  |   photoprism = import ./photoprism.nix; #TODO remove once updated to 23.05, stolen from nixpkgs anyway | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										154
									
								
								modules/nixos/photoprism.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										154
									
								
								modules/nixos/photoprism.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,154 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | let | ||||||
|  |   cfg = config.services.photoprism; | ||||||
|  | 
 | ||||||
|  |   env = { | ||||||
|  |     PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath; | ||||||
|  |     PHOTOPRISM_STORAGE_PATH = cfg.storagePath; | ||||||
|  |     PHOTOPRISM_IMPORT_PATH = cfg.importPath; | ||||||
|  |     PHOTOPRISM_HTTP_HOST = cfg.address; | ||||||
|  |     PHOTOPRISM_HTTP_PORT = toString cfg.port; | ||||||
|  |   } // ( | ||||||
|  |     lib.mapAttrs (_: toString) cfg.settings | ||||||
|  |   ); | ||||||
|  | 
 | ||||||
|  |   manage = | ||||||
|  |     let | ||||||
|  |       setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env); | ||||||
|  |     in | ||||||
|  |     pkgs.writeShellScript "manage" '' | ||||||
|  |       ${setupEnv} | ||||||
|  |       exec ${cfg.package}/bin/photoprism "$@" | ||||||
|  |     ''; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   meta.maintainers = with lib.maintainers; [ stunkymonkey ]; | ||||||
|  | 
 | ||||||
|  |   options.services.photoprism = { | ||||||
|  | 
 | ||||||
|  |     enable = lib.mkEnableOption (lib.mdDoc "Photoprism web server"); | ||||||
|  | 
 | ||||||
|  |     passwordFile = lib.mkOption { | ||||||
|  |       type = lib.types.nullOr lib.types.path; | ||||||
|  |       default = null; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Admin password file. | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     address = lib.mkOption { | ||||||
|  |       type = lib.types.str; | ||||||
|  |       default = "localhost"; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Web interface address. | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     port = lib.mkOption { | ||||||
|  |       type = lib.types.port; | ||||||
|  |       default = 2342; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Web interface port. | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     originalsPath = lib.mkOption { | ||||||
|  |       type = lib.types.path; | ||||||
|  |       default = null; | ||||||
|  |       example = "/data/photos"; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Storage path of your original media files (photos and videos). | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     importPath = lib.mkOption { | ||||||
|  |       type = lib.types.str; | ||||||
|  |       default = "import"; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Relative or absolute to the `originalsPath` from where the files should be imported. | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     storagePath = lib.mkOption { | ||||||
|  |       type = lib.types.path; | ||||||
|  |       default = "/var/lib/photoprism"; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         Location for sidecar, cache, and database files. | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     package = lib.mkPackageOptionMD pkgs "photoprism" { }; | ||||||
|  | 
 | ||||||
|  |     settings = lib.mkOption { | ||||||
|  |       type = lib.types.attrsOf lib.types.str; | ||||||
|  |       default = { }; | ||||||
|  |       description = lib.mdDoc '' | ||||||
|  |         See [the getting-started guide](https://docs.photoprism.app/getting-started/config-options/) for available options. | ||||||
|  |       ''; | ||||||
|  |       example = { | ||||||
|  |         PHOTOPRISM_DEFAULT_LOCALE = "de"; | ||||||
|  |         PHOTOPRISM_ADMIN_USER = "root"; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = lib.mkIf cfg.enable { | ||||||
|  |     systemd.services.photoprism = { | ||||||
|  |       description = "Photoprism server"; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         Restart = "on-failure"; | ||||||
|  |         User = "photoprism"; | ||||||
|  |         Group = "photoprism"; | ||||||
|  |         DynamicUser = true; | ||||||
|  |         StateDirectory = "photoprism"; | ||||||
|  |         WorkingDirectory = "/var/lib/photoprism"; | ||||||
|  |         RuntimeDirectory = "photoprism"; | ||||||
|  | 
 | ||||||
|  |         LoadCredential = lib.optionalString (cfg.passwordFile != null) | ||||||
|  |           "PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}"; | ||||||
|  | 
 | ||||||
|  |         CapabilityBoundingSet = ""; | ||||||
|  |         LockPersonality = true; | ||||||
|  |         PrivateDevices = true; | ||||||
|  |         PrivateUsers = true; | ||||||
|  |         ProtectClock = true; | ||||||
|  |         ProtectControlGroups = true; | ||||||
|  |         ProtectHome = true; | ||||||
|  |         ProtectHostname = true; | ||||||
|  |         ProtectKernelLogs = true; | ||||||
|  |         ProtectKernelModules = true; | ||||||
|  |         ProtectKernelTunables = true; | ||||||
|  |         RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; | ||||||
|  |         RestrictNamespaces = true; | ||||||
|  |         RestrictRealtime = true; | ||||||
|  |         SystemCallArchitectures = "native"; | ||||||
|  |         SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ]; | ||||||
|  |         UMask = "0066"; | ||||||
|  |       } // lib.optionalAttrs (cfg.port < 1024) { | ||||||
|  |         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; | ||||||
|  |         CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       environment = env; | ||||||
|  | 
 | ||||||
|  |       # reminder: easier password configuration will come in https://github.com/photoprism/photoprism/pull/2302 | ||||||
|  |       preStart = '' | ||||||
|  |         ln -sf ${manage} photoprism-manage | ||||||
|  | 
 | ||||||
|  |         ${lib.optionalString (cfg.passwordFile != null) '' | ||||||
|  |           export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD") | ||||||
|  |         ''} | ||||||
|  |         exec ${cfg.package}/bin/photoprism migrations run -f | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       script = '' | ||||||
|  |         ${lib.optionalString (cfg.passwordFile != null) '' | ||||||
|  |           export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD") | ||||||
|  |         ''} | ||||||
|  |         exec ${cfg.package}/bin/photoprism start | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										8
									
								
								secrets/photoprism.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										8
									
								
								secrets/photoprism.age
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,8 @@ | ||||||
|  | age-encryption.org/v1 | ||||||
|  | -> ssh-ed25519 K2vF/Q gbzVy3hrykVeOCwjPo6Ma8tTTemdtiRwAtX96cA2viE | ||||||
|  | NFSztfWodmZ4TQFBMgx9e1U2ZO37Nt/MKJEYBBrICrA | ||||||
|  | -> s.pLZ.|-grease %UVo!F YgUB rG`)8.@w | ||||||
|  | pYerZHERVJx3dldU27I9vIxh5mizU4cW4F1QTRxk646K0abW7H6rqp6Qyr096fLF | ||||||
|  | c9egbGKMJFNgWoXWaauMaGCAV2D8km5DHSWVoEMZVkskQSprSUWh | ||||||
|  | --- SANH4pgKXob6sZ/jhnqkgXFC9QzVbI81HqxvwiayK2Y | ||||||
|  | õÐ4¿ÆÝž•ë LªH²jæœ[§È˜p(löl@™GÊà¸ÍRƒr‰)P¤0Q?àG•®ÂaÜfú€ø»÷<> | ||||||
|  | @ -17,6 +17,7 @@ in | ||||||
|   "box-wg.age".publicKeys = [ mossnet ]; |   "box-wg.age".publicKeys = [ mossnet ]; | ||||||
|   "wallabag-password.age".publicKeys = [ mossnet ]; |   "wallabag-password.age".publicKeys = [ mossnet ]; | ||||||
|   "wallabag-secret.age".publicKeys = [ mossnet ]; |   "wallabag-secret.age".publicKeys = [ mossnet ]; | ||||||
|  |   "photoprism.age".publicKeys = [ mossnet ]; | ||||||
| 
 | 
 | ||||||
|   "borg-password.age".publicKeys = systemOnly; |   "borg-password.age".publicKeys = systemOnly; | ||||||
|   "borg-key.age".publicKeys = systemOnly; |   "borg-key.age".publicKeys = systemOnly; | ||||||
|  |  | ||||||
		Loading…
	
		Reference in a new issue