numbus-server-module/modules/services/immich.nix

{ config, pkgs, lib, ... }:

with lib;

let
  immichVersion = "v2.5.6";
  redisVersion = "9@sha256:546304417feac0874c3dd576e0952c6bb8f06bb4093ea0c9ca303c73cf458f63";
  databaseVersion = "14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23";
  helper = import ./lib.nix { inherit config pkgs lib; };
  cfg = config.numbus.services.immich;
in

helper.mkPodmanService {
  description = "Immich, Google Photos but better";
  name = "immich";
  pod = "immich";
  defaultPort = "2283";
  useSopsSecrets = true;

  extraConfig = {
    numbus.services.immich.secretMapping = {
      DB_PASSWORD = "db_password";
      DB_USERNAME = "db_username"; # Assuming you add this to schema
    };
  };

# Compose file good
  composeText = ''
    services:
      immich-server:
        container_name: immich-server
        hostname: immich-server
        image: ghcr.io/immich-app/immich-server:${immichVersion}
        user: '1000:1000'
        networks:
          immich:
        ports:
          - "${cfg.port}:2283/tcp"
        volumes:
          - $UPLOAD_LOCATION:/data
          - /etc/localtime:/etc/localtime:ro
        env_file:
          - .env
        depends_on:
          - immich-redis
          - immich-database
        healthcheck:
          disable: false
        security_opt:
          - no-new-privileges:true
        cap_drop:
          - NET_RAW
        restart: unless-stopped
      immich-machine-learning:
        container_name: immich-machine-learning
        hostname: immich-machine-learning
        image: ghcr.io/immich-app/immich-machine-learning:${immichVersion}
        user: '1000:1000'
        networks:
          immich:
        volumes:
          - ${cfg.configDir}/model-cache:/cache
          - ${cfg.configDir}/machine-learning-config:/usr/src/.config
          - ${cfg.configDir}/machine-learning-cache:/usr/src/.cache/
        env_file:
          - .env
        healthcheck:
          disable: false
        security_opt:
          - no-new-privileges:true
        cap_drop:
          - NET_RAW
        restart: unless-stopped
      immich-redis:
        container_name: immich-redis
        hostname: immich-redis
        image: docker.io/valkey/valkey:${redisVersion}
        user: '1000:1000'
        networks:
          immich:
        healthcheck:
          test: redis-cli ping || exit 1
        restart: unless-stopped
      immich-database:
        container_name: immich-database
        hostname: immich-database
        image: ghcr.io/immich-app/postgres:${databaseVersion}
        user: '999:999'
        networks:
          immich:
        environment:
          POSTGRES_PASSWORD: $DB_PASSWORD
          POSTGRES_USER: $DB_USERNAME
          POSTGRES_DB: $DB_DATABASE_NAME
          POSTGRES_INITDB_ARGS: '--data-checksums'
        volumes:
          - $DB_DATA_LOCATION:/var/lib/postgresql/data
        shm_size: 128mb
        healthcheck:
          disable: false
        security_opt:
          - no-new-privileges:true
        cap_drop:
          - NET_RAW
        restart: unless-stopped
    networks:
      immich:
        name: immich
        driver: bridge
  '';
}