-
-
Notifications
You must be signed in to change notification settings - Fork 14.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
nixos/immich-public-proxy: init module
- Loading branch information
1 parent
9d99e48
commit 6d49b12
Showing
6 changed files
with
193 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| { | ||
| config, | ||
| lib, | ||
| pkgs, | ||
| ... | ||
| }: | ||
| let | ||
| cfg = config.services.immich-public-proxy; | ||
| inherit (lib) | ||
| types | ||
| mkIf | ||
| mkOption | ||
| mkEnableOption | ||
| ; | ||
| in | ||
| { | ||
| options.services.immich-public-proxy = { | ||
| enable = mkEnableOption "Immich Public Proxy"; | ||
| package = lib.mkPackageOption pkgs "immich-public-proxy" { }; | ||
|
|
||
| immich-url = mkOption { | ||
| type = types.str; | ||
| description = "URL of the Immich instance"; | ||
| }; | ||
|
|
||
| port = mkOption { | ||
| type = types.port; | ||
| default = 3000; | ||
| description = "The port that IPP will listen on."; | ||
| }; | ||
| openFirewall = mkOption { | ||
| type = types.bool; | ||
| default = false; | ||
| description = "Whether to open the IPP port in the firewall"; | ||
| }; | ||
| }; | ||
|
|
||
| config = mkIf cfg.enable { | ||
| systemd.services.immich-public-proxy = { | ||
| description = "Immich public proxy for sharing albums publicly without exposing your Immich instance"; | ||
| after = [ "network.target" ]; | ||
| wantedBy = [ "multi-user.target" ]; | ||
| environment = { | ||
| IMMICH_URL = cfg.immich-url; | ||
| IPP_PORT = builtins.toString cfg.port; | ||
| }; | ||
| serviceConfig = { | ||
| ExecStart = lib.getExe cfg.package; | ||
| SyslogIdentifier = "ipp"; | ||
| User = "ipp"; | ||
| Group = "ipp"; | ||
| DynamicUser = true; | ||
| Type = "simple"; | ||
| Restart = "on-failure"; | ||
| RestartSec = 3; | ||
|
|
||
| # Hardening | ||
| CapabilityBoundingSet = ""; | ||
| NoNewPrivileges = true; | ||
| PrivateUsers = true; | ||
| PrivateTmp = true; | ||
| PrivateDevices = true; | ||
| PrivateMounts = true; | ||
| ProtectClock = true; | ||
| ProtectControlGroups = true; | ||
| ProtectHome = true; | ||
| ProtectHostname = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| RestrictAddressFamilies = [ | ||
| "AF_INET" | ||
| "AF_INET6" | ||
| "AF_UNIX" | ||
| ]; | ||
| RestrictNamespaces = true; | ||
| RestrictRealtime = true; | ||
| RestrictSUIDSGID = true; | ||
| }; | ||
| }; | ||
|
|
||
| networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; | ||
|
|
||
| meta.maintainers = with lib.maintainers; [ jaculabilis ]; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| import ../make-test-python.nix ( | ||
| { pkgs, lib, ... }: | ||
| { | ||
| name = "immich-public-proxy"; | ||
|
|
||
| nodes.machine = | ||
| { pkgs, ... }@args: | ||
| { | ||
| environment.systemPackages = [ | ||
| pkgs.imagemagick | ||
| pkgs.immich-cli | ||
| ]; | ||
| services.immich = { | ||
| enable = true; | ||
| port = 2283; | ||
| # disable a lot of features that aren't needed for this test | ||
| machine-learning.enable = false; | ||
| settings = { | ||
| backup.database.enabled = false; | ||
| machineLearning.enabled = false; | ||
| map.enabled = false; | ||
| reverseGeocoding.enabled = false; | ||
| metadata.faces.import = false; | ||
| newVersionCheck.enabled = false; | ||
| notifications.smtp.enabled = false; | ||
| }; | ||
| }; | ||
| services.immich-public-proxy = { | ||
| enable = true; | ||
| immich-url = "http://localhost:2283"; | ||
| port = 8002; | ||
| }; | ||
| }; | ||
|
|
||
| testScript = '' | ||
| import json | ||
| machine.wait_for_unit("immich-server.service") | ||
| machine.wait_for_unit("immich-public-proxy.service") | ||
| machine.wait_for_open_port(2283) | ||
| machine.wait_for_open_port(8002) | ||
| # The proxy should be up | ||
| machine.succeed("curl -sf http://localhost:8002") | ||
| # Verify the static assets are served | ||
| machine.succeed("curl -sf http://localhost:8002/robots.txt") | ||
| machine.succeed("curl -sf http://localhost:8002/share/static/style.css") | ||
| # Log in to Immich and create an access key | ||
| machine.succeed(""" | ||
| curl -sf --json '{ "email": "[email protected]", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up | ||
| """) | ||
| res = machine.succeed(""" | ||
| curl -sf --json '{ "email": "[email protected]", "password": "admin" }' http://localhost:2283/api/auth/login | ||
| """) | ||
| token = json.loads(res)['accessToken'] | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys | ||
| """ % token) | ||
| key = json.loads(res)['secret'] | ||
| machine.succeed(f"immich login http://localhost:2283/api {key}") | ||
| res = machine.succeed("immich server-info") | ||
| print(res) | ||
| # Upload some blank images to a new album | ||
| # If there's only one image, the proxy serves the image directly | ||
| machine.succeed("magick -size 800x600 canvas:white /tmp/white.png") | ||
| machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/white.png") | ||
| machine.succeed("magick -size 800x600 canvas:black /tmp/black.png") | ||
| machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/black.png") | ||
| res = machine.succeed("immich server-info") | ||
| print(res) | ||
| # Get the new album id | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/albums | ||
| """ % token) | ||
| album_id = json.loads(res)[0]['id'] | ||
| # Create a shared link | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "albumId": "%s", "type": "ALBUM" }' http://localhost:2283/api/shared-links | ||
| """ % (token, album_id)) | ||
| share_key = json.loads(res)['key'] | ||
| # Access the share | ||
| machine.succeed(""" | ||
| curl -sf http://localhost:2283/share/%s | ||
| """ % share_key) | ||
| # Access the share through the proxy | ||
| machine.succeed(""" | ||
| curl -sf http://localhost:8002/share/%s | ||
| """ % share_key) | ||
| ''; | ||
| } | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters