run immich-ml from ytnix and add tailscale0 to trustedInterfaces
This commit is contained in:
parent
59de12e892
commit
553a07f0a9
5 changed files with 50 additions and 23 deletions
|
@ -101,6 +101,7 @@
|
||||||
wl-clipboard-rs
|
wl-clipboard-rs
|
||||||
pixelflasher
|
pixelflasher
|
||||||
element-desktop
|
element-desktop
|
||||||
|
freetube
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.feh.enable = true;
|
programs.feh.enable = true;
|
||||||
|
|
|
@ -79,6 +79,7 @@
|
||||||
networkmanager.enable = true;
|
networkmanager.enable = true;
|
||||||
firewall = {
|
firewall = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
trustedInterfaces = [ "tailscale0" ];
|
||||||
allowedTCPPorts = [
|
allowedTCPPorts = [
|
||||||
22
|
22
|
||||||
80
|
80
|
||||||
|
@ -86,8 +87,6 @@
|
||||||
];
|
];
|
||||||
allowedUDPPorts = [
|
allowedUDPPorts = [
|
||||||
443
|
443
|
||||||
53
|
|
||||||
853
|
|
||||||
];
|
];
|
||||||
extraCommands =
|
extraCommands =
|
||||||
let
|
let
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
{
|
{
|
||||||
pkgs,
|
pkgs,
|
||||||
config,
|
config,
|
||||||
|
lib,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
|
@ -67,21 +68,9 @@ in
|
||||||
];
|
];
|
||||||
networks = [ "immich-net" ];
|
networks = [ "immich-net" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
# immich-ml = {
|
|
||||||
# image = "ghcr.io/immich-app/immich-machine-learning:release";
|
|
||||||
# autoStart = true;
|
|
||||||
# pull = "newer";
|
|
||||||
# environment = {
|
|
||||||
# REDIS_HOSTNAME = "immich-redis";
|
|
||||||
# DB_HOSTNAME = "immich-db";
|
|
||||||
# };
|
|
||||||
# volumes = [ "${modelCache}:/cache" ];
|
|
||||||
# networks = [ "immich-net" ];
|
|
||||||
# };
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.create-immich-net = {
|
systemd.services.create-immich-net = rec {
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
requiredBy = with config.virtualisation.oci-containers; [
|
requiredBy = with config.virtualisation.oci-containers; [
|
||||||
"${backend}-immich.service"
|
"${backend}-immich.service"
|
||||||
|
@ -89,10 +78,10 @@ in
|
||||||
"${backend}-immich-redis.service"
|
"${backend}-immich-redis.service"
|
||||||
# "${backend}-immich-ml.service"
|
# "${backend}-immich-ml.service"
|
||||||
];
|
];
|
||||||
before = config.systemd.services.create-immich-net.requiredBy;
|
before = requiredBy;
|
||||||
script = ''
|
script = ''
|
||||||
${pkgs.podman}/bin/podman network exists immich-net || \
|
${lib.getExe pkgs.podman} network exists immich-net || \
|
||||||
${pkgs.podman}/bin/podman network create immich-net
|
${lib.getExe pkgs.podman} network create immich-net
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
36
hosts/ytnix/containers.nix
Normal file
36
hosts/ytnix/containers.nix
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
virtualisation.oci-containers.containers = {
|
||||||
|
immich-ml = let
|
||||||
|
modelCache = "/opt/immich-ml";
|
||||||
|
in {
|
||||||
|
image = "ghcr.io/immich-app/immich-machine-learning:release";
|
||||||
|
autoStart = true;
|
||||||
|
pull = "newer";
|
||||||
|
ports = [ "3003:3003" ];
|
||||||
|
environment = {
|
||||||
|
REDIS_HOSTNAME = "immich-redis";
|
||||||
|
DB_HOSTNAME = "immich-db";
|
||||||
|
};
|
||||||
|
volumes = [ "${modelCache}:/cache" ];
|
||||||
|
networks = [ "immich-net" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.create-immich-net = rec {
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
requiredBy = with config.virtualisation.oci-containers; [
|
||||||
|
"${backend}-immich-ml.service"
|
||||||
|
];
|
||||||
|
before = requiredBy;
|
||||||
|
script = ''
|
||||||
|
${lib.getExe pkgs.podman} network exists immich-net || \
|
||||||
|
${lib.getExe pkgs.podman} network create immich-net
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
|
@ -10,6 +10,7 @@
|
||||||
../common.nix
|
../common.nix
|
||||||
../zsh.nix
|
../zsh.nix
|
||||||
./tailscale.nix
|
./tailscale.nix
|
||||||
|
./containers.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.age.keyFile = "/root/.config/sops/age/keys.txt";
|
sops.age.keyFile = "/root/.config/sops/age/keys.txt";
|
||||||
|
@ -86,10 +87,12 @@
|
||||||
resolvconf.enable = true;
|
resolvconf.enable = true;
|
||||||
firewall = {
|
firewall = {
|
||||||
enable = true;
|
enable = true;
|
||||||
allowedTCPPorts = [
|
trustedInterfaces = [ "tailscale0" ];
|
||||||
8080 # mitmproxy
|
# allowedTCPPorts = [
|
||||||
22000 # syncthing
|
# 8080 # mitmproxy
|
||||||
];
|
# 22000 # syncthing
|
||||||
|
# 3003 # immich-ml
|
||||||
|
# ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
programs.nm-applet.enable = true;
|
programs.nm-applet.enable = true;
|
||||||
|
@ -252,7 +255,6 @@
|
||||||
xdg.mime.defaultApplications = {
|
xdg.mime.defaultApplications = {
|
||||||
"application/pdf" = "okular.desktop";
|
"application/pdf" = "okular.desktop";
|
||||||
"image/*" = "gwenview.desktop";
|
"image/*" = "gwenview.desktop";
|
||||||
"*/html" = "chromium-browser.desktop";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualisation = {
|
virtualisation = {
|
||||||
|
|
Loading…
Add table
Reference in a new issue