run immich-ml from ytnix and add tailscale0 to trustedInterfaces

This commit is contained in:
cy 2025-03-09 22:23:58 -04:00
parent 59de12e892
commit 553a07f0a9
Signed by: cy
SSH key fingerprint: SHA256:o/geVWV4om1QhUSkKvDQeW/eAihwnjyXkqMwrVdbuts
5 changed files with 50 additions and 23 deletions

View file

@ -101,6 +101,7 @@
wl-clipboard-rs wl-clipboard-rs
pixelflasher pixelflasher
element-desktop element-desktop
freetube
]; ];
programs.feh.enable = true; programs.feh.enable = true;

View file

@ -79,6 +79,7 @@
networkmanager.enable = true; networkmanager.enable = true;
firewall = { firewall = {
enable = true; enable = true;
trustedInterfaces = [ "tailscale0" ];
allowedTCPPorts = [ allowedTCPPorts = [
22 22
80 80
@ -86,8 +87,6 @@
]; ];
allowedUDPPorts = [ allowedUDPPorts = [
443 443
53
853
]; ];
extraCommands = extraCommands =
let let

View file

@ -1,6 +1,7 @@
{ {
pkgs, pkgs,
config, config,
lib,
... ...
}: }:
let let
@ -67,21 +68,9 @@ in
]; ];
networks = [ "immich-net" ]; networks = [ "immich-net" ];
}; };
# immich-ml = {
# image = "ghcr.io/immich-app/immich-machine-learning:release";
# autoStart = true;
# pull = "newer";
# environment = {
# REDIS_HOSTNAME = "immich-redis";
# DB_HOSTNAME = "immich-db";
# };
# volumes = [ "${modelCache}:/cache" ];
# networks = [ "immich-net" ];
# };
}; };
systemd.services.create-immich-net = { systemd.services.create-immich-net = rec {
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
requiredBy = with config.virtualisation.oci-containers; [ requiredBy = with config.virtualisation.oci-containers; [
"${backend}-immich.service" "${backend}-immich.service"
@ -89,10 +78,10 @@ in
"${backend}-immich-redis.service" "${backend}-immich-redis.service"
# "${backend}-immich-ml.service" # "${backend}-immich-ml.service"
]; ];
before = config.systemd.services.create-immich-net.requiredBy; before = requiredBy;
script = '' script = ''
${pkgs.podman}/bin/podman network exists immich-net || \ ${lib.getExe pkgs.podman} network exists immich-net || \
${pkgs.podman}/bin/podman network create immich-net ${lib.getExe pkgs.podman} network create immich-net
''; '';
}; };

View file

@ -0,0 +1,36 @@
{
config,
pkgs,
lib,
...
}:
{
virtualisation.oci-containers.containers = {
immich-ml = let
modelCache = "/opt/immich-ml";
in {
image = "ghcr.io/immich-app/immich-machine-learning:release";
autoStart = true;
pull = "newer";
ports = [ "3003:3003" ];
environment = {
REDIS_HOSTNAME = "immich-redis";
DB_HOSTNAME = "immich-db";
};
volumes = [ "${modelCache}:/cache" ];
networks = [ "immich-net" ];
};
};
systemd.services.create-immich-net = rec {
serviceConfig.Type = "oneshot";
requiredBy = with config.virtualisation.oci-containers; [
"${backend}-immich-ml.service"
];
before = requiredBy;
script = ''
${lib.getExe pkgs.podman} network exists immich-net || \
${lib.getExe pkgs.podman} network create immich-net
'';
};
}

View file

@ -10,6 +10,7 @@
../common.nix ../common.nix
../zsh.nix ../zsh.nix
./tailscale.nix ./tailscale.nix
./containers.nix
]; ];
sops.age.keyFile = "/root/.config/sops/age/keys.txt"; sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@ -86,10 +87,12 @@
resolvconf.enable = true; resolvconf.enable = true;
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ trustedInterfaces = [ "tailscale0" ];
8080 # mitmproxy # allowedTCPPorts = [
22000 # syncthing # 8080 # mitmproxy
]; # 22000 # syncthing
# 3003 # immich-ml
# ];
}; };
}; };
programs.nm-applet.enable = true; programs.nm-applet.enable = true;
@ -252,7 +255,6 @@
xdg.mime.defaultApplications = { xdg.mime.defaultApplications = {
"application/pdf" = "okular.desktop"; "application/pdf" = "okular.desktop";
"image/*" = "gwenview.desktop"; "image/*" = "gwenview.desktop";
"*/html" = "chromium-browser.desktop";
}; };
virtualisation = { virtualisation = {