new host for immich, with gpu

3 files changed, 87 insertions, 8 deletions

diff --git a/nix/flake.nix b/nix/flake.nix
index ccc45ad..72c53d3 100644
--- a/nix/flake.nix
+++ b/nix/flake.nix
@@ -36,6 +36,15 @@
         ];
       };
 
+      "photos" = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./per-host/base/configuration.nix
+          ./per-host/photos/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
+
       "rproxy-2" = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
diff --git a/nix/per-host/photos/configuration.nix b/nix/per-host/photos/configuration.nix
index 15f1953..ca9d736 100644
--- a/nix/per-host/photos/configuration.nix
+++ b/nix/per-host/photos/configuration.nix
@@ -6,12 +6,8 @@
     sops.defaultSopsFile = ../../secrets/photos.yaml;
 
     networking.hostName = "photos";
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
-    
-    hardware.graphics = {
-      enable = true;
-    };
 
+    hardware.graphics.enable = true;
     hardware.nvidia = {
       modesetting.enable = true;
       nvidiaPersistenced = true;
@@ -21,20 +17,59 @@
       nvidiaSettings = true;
       package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
     };
+    services.xserver.videoDrivers = [ "nvidia" ];
 
     nixpkgs.config.allowUnfree = true;
 
-    services.xserver.videoDrivers = [ "nvidia" ];
+    # Immich 3.1.x ML is broken, we a patch to remove OpenVINO
+    # See: https://github.com/immich-app/immich/issues/25830
+    services.immich.package = pkgs.immich.overrideAttrs (old: {
+      passthru = (old.passthru or { }) // {
+        machine-learning = pkgs.immich.machine-learning.overrideAttrs (old: {
+          postPatch = (old.postPatch or "") + ''
+            substituteInPlace immich_ml/models/constants.py \
+              --replace-fail '"OpenVINOExecutionProvider",' ""
+            substituteInPlace test_main.py \
+              --replace-fail "def test_sets_openvino_provider_if_available" "def skipped_sets_openvino_provider_if_available"
+          '';
+        });
+      };
+    });
+
+    services.immich = {
+      enable = true;
+      host = "0.0.0.0";
+      openFirewall = true;
+      environment.LD_LIBRARY_PATH = "/run/opengl-driver/lib";
+      accelerationDevices = null;
+      settings = {
+        server.externalDomain = "https://photos.kumardamani.net";
+        ffmpeg.accel = "nvenc";
+        ffmpeg.accelDecode = true;
+        machineLearning.ocr.enabled = false;
+        library.scan = {
+          enabled = true;
+          cronExpression = "0 * * * *";
+        };
+        image.previewSize = 1080;
+      };
+    };
+
+    services.immich.environment.IMMICH_LOG_LEVEL = "warn";
 
     fileSystems = {
       "/mnt/data/kumar/legacy-media" = {
         device = "nas.bacala:/mnt/tank/customers/kumar/legacy-media";
         fsType = "nfs";
       };
-      "/mnt/data/kumar/camera" = {
+      "/mnt/data/kumar/phone/camera" = {
         device = "nas.bacala:/mnt/tank/customers/kumar/phone/camera";
         fsType = "nfs";
       };
+      "/mnt/data/kumar/phone/pics" = {
+        device = "nas.bacala:/mnt/tank/customers/kumar/phone/pics";
+        fsType = "nfs";
+      };
     };
   };
 }
diff --git a/nix/secrets/photos.yaml b/nix/secrets/photos.yaml
index 97ad87b..629789e 100644
--- a/nix/secrets/photos.yaml
+++ b/nix/secrets/photos.yaml
@@ -1 +1,36 @@
-foo: "bar"
+immich:
+    admin-password: ENC[AES256_GCM,data:GW6THiBKbwP0Khx7s9lIg5phXN6BYhtZeo7Y1QUXds8=,iv:UrFmKgF9ADLaw71Ru8qtOGWPYGgrXqNwMmnhsfrNWqM=,tag:iqVHRR7J7eLS0jaUKjoAtw==,type:str]
+    stephanie-password: ENC[AES256_GCM,data:ZNdmynsYDKgQqeGB8/Rt0A/0Z+fOaswUsAdnzdKQgDY=,iv:jKMSlzbRZl2ilXLyZKNq2vHieHxOt9CMLrtryanXU7Y=,tag:BEsKU9KJtaNnA5XwxVddJg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZzFiZEVka2FHeVpFN1E4
+            ZVhJMzNYV0lZWGFPNlNNa1FYcGZsd0J6M1dnCkdLcEdxSHIzY0pCRFhvanU3SUdy
+            SkRNTG1kNnlDN1FKUlNnR0k2Q3J2dWMKLS0tIFRsMkZHbFVrbVdmUlFDMkc2aWlu
+            NEdrWUt0V0ZUdXR6SWZYWGY2M2ZyY0kK75TpNN3frvTWQzPv/1fRgbZg1556ao/0
+            NLWlvbChdjqroUYvdBIlOoiQHiBuJHnKIU7M6cPy8c+bpV4+1m8XiQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age12teny70e5cm3992z7atx9g9606d4a60dsl8nskzkpp234uelnctq82mqaa
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjc2hONXJzVExLRmtHTDdJ
+            bWxQQXVrTHRIcjJja2VqNkZJSlVrNTMrYjJvCjAzWGhIMVFYNW12NmdwMmViNWRr
+            aDF2Y2hXL1o1WU52OUdLVkFSNjdlTEEKLS0tIGYrR2UwV0xLRGFKVGs1Y3pDS0dx
+            VXQ3dG5KVVF5SzJWSFdpaytoSS9IQm8K4d5rHy2qAyKlQ5JUF5aKzLKHSCfRHJuX
+            TL6XTmgu2m36WN3p8NNU+a+HcbrlrjplDx5Oh0mlZhKZeHmf6UA3Mg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age183q00vnssxx9ksdktsave78js2yggtcaahkf3qqh9j3yj88w54xq722xhy
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQUVUM0lnL01sTEJyOTAw
+            RU93bzJCS3BOcXhwa1BHVXZBSzdvWi9RUlVFCkpDUXBrQWpSa25HaW5DWk4rRml0
+            RmFaS2syUlJNUlRSSXhnNERpQmhXUHcKLS0tIFo0bGZqN0FXSFRuVFhVYUw3em1D
+            cUJNcG11TlhOc2c3alMvWWMvSUpXbk0KVRdiNAZVJdzjRpWoGWkEW/rmsdAfAbOg
+            5HOOZglpPP70OBPHtBwWg6KV88oLyZKqYA5VIWrmRvE71hg21Jbfuw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zdy4saxtcs6y90mrjlmz6hnknk67w0cd3n79g2y6fvtzzfsq6f6shwamzj
+    lastmodified: "2026-09-10T15:05:50Z"
+    mac: ENC[AES256_GCM,data:mIPPLbEij+8/PdOSqCujD0wVRn1jB4wQmiTxaSeMLlbrqJEfZIPRDdOdOQho0Phohk6QPANL/g0ZqQnFDVWlFZcJ8/ShNssre+CR4kC9x2GMlhkvO9sgqJ+KrsZ5/vcw23tQiwOXZYvqSpVyqnSE1nZvfCr70+9R15cA0MIQlvQ=,iv:M33dCKmpto4004YV3xlFgEaiCTcbujtksBsIYcEGR+o=,tag:ljURSrLqG5oSblkDP8Hlog==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3