{ config, lib, pkgs, ... }: let inherit (lib) mkEnableOption mkIf mkOption ; cfg = config.my.services.immich; my = config.my; domain = config.networking.domain; hostname = config.networking.hostName; fqdn = "${hostname}.${domain}"; in { options.my.services.immich = let inherit (lib) types; in { enable = mkEnableOption "Immich config"; home = mkOption { type = types.str; default = "/var/lib/immich"; example = "/var/lib/immich"; description = "Home for the immich service, where data will be stored"; }; port = mkOption { type = types.port; example = 8080; description = "Internal port for Immich webapp"; }; }; config = mkIf cfg.enable { users.users.immich = { isSystemUser = true; home = cfg.home; createHome = true; group = "immich"; }; users.groups.immich = {}; services.nginx.virtualHosts = { "immich.${domain}" = { forceSSL = true; useACMEHost = fqdn; listen = [ # FIXME: hardcoded tailscale IP { addr = "100.115.172.44"; port = 443; ssl = true; } { addr = "100.115.172.44"; port = 80; ssl = false; } ]; locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.port}"; proxyWebsockets = true; }; extraConfig = '' proxy_connect_timeout 600; proxy_read_timeout 600; proxy_send_timeout 600; client_max_body_size 500m; access_log syslog:server=unix:/dev/log,tag=immich; ''; }; }; security.acme.certs.${fqdn}.extraDomainNames = ["immich.${domain}"]; }; }