From 68b5f86bd58e00fa9ddc93a606e845da1f29a8ad Mon Sep 17 00:00:00 2001 From: Constantin Gierczak--Galle Date: Fri, 22 Nov 2024 14:04:37 +0100 Subject: [PATCH] feat(photo01): init (#4) Reviewed-on: https://git.dgnum.eu/DGNum/lab-infra/pulls/4 Co-authored-by: Constantin Gierczak--Galle Co-committed-by: Constantin Gierczak--Galle --- machines/photo01/_configuration.nix | 56 ++++++++++++++++++++ machines/photo01/_hardware-configuration.nix | 35 ++++++++++++ machines/photo01/immich.nix | 16 ++++++ machines/photo01/nginx.nix | 10 ++++ machines/photo01/openssh.nix | 8 +++ machines/photo01/photoprism.nix | 54 +++++++++++++++++++ machines/photo01/secrets/secrets.nix | 3 ++ meta/network.nix | 7 +++ meta/nodes.nix | 10 +++- 9 files changed, 198 insertions(+), 1 deletion(-) create mode 100644 machines/photo01/_configuration.nix create mode 100644 machines/photo01/_hardware-configuration.nix create mode 100644 machines/photo01/immich.nix create mode 100644 machines/photo01/nginx.nix create mode 100644 machines/photo01/openssh.nix create mode 100644 machines/photo01/photoprism.nix create mode 100644 machines/photo01/secrets/secrets.nix diff --git a/machines/photo01/_configuration.nix b/machines/photo01/_configuration.nix new file mode 100644 index 0000000..4da2284 --- /dev/null +++ b/machines/photo01/_configuration.nix @@ -0,0 +1,56 @@ +# TODO: revamp to use the same framework as the other VMs +{ pkgs, ... }: + +let + address = "129.199.146.101"; +in +{ + imports = [ + ./_hardware-configuration.nix + + # NOTE: For now, only deploy the bare minimum + ./immich.nix + ./nginx.nix + ./photoprism.nix + ]; + deployment.targetHost = address; + + networking = { + firewall.allowedTCPPorts = [ + 22 + 80 + 443 + 8007 + ]; + firewall.allowedUDPPorts = [ ]; + useNetworkd = true; + }; + + time.timeZone = "Europe/Paris"; + environment.systemPackages = with pkgs; [ neovim ]; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270" + ]; + + security.acme.acceptTerms = true; + + systemd.network = { + config.routeTables = { + he = 100; + mwan = 110; + }; + networks = { + "10-ens18" = { + name = "ens18"; + + networkConfig = { + Description = "ENS uplink"; + Address = [ "129.199.146.101/24" ]; + Gateway = "129.199.146.254"; + LLDP = true; + }; + }; + }; + }; +} diff --git a/machines/photo01/_hardware-configuration.nix b/machines/photo01/_hardware-configuration.nix new file mode 100644 index 0000000..e87eb0d --- /dev/null +++ b/machines/photo01/_hardware-configuration.nix @@ -0,0 +1,35 @@ +{ lib, modulesPath, ... }: + +{ + imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; + + boot = { + loader.systemd-boot.enable = true; + initrd.kernelModules = [ ]; + kernelModules = [ ]; + extraModulePackages = [ ]; + initrd.availableKernelModules = [ + "ata_piix" + "uhci_hcd" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; + + }; + + fileSystems."/" = { + device = "/dev/disk/by-partlabel/disk-sda-root"; + fsType = "ext4"; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-partlabel/disk-sda-ESP"; + fsType = "vfat"; + }; + + networking.useDHCP = lib.mkDefault false; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/machines/photo01/immich.nix b/machines/photo01/immich.nix new file mode 100644 index 0000000..3d1f0c9 --- /dev/null +++ b/machines/photo01/immich.nix @@ -0,0 +1,16 @@ +{ + services.immich = { + enable = true; + # NOTE: default port changes in a later version + port = 3001; + machine-learning.enable = true; + host = "localhost"; + }; + + services.nginx.virtualHosts."immich.cgiga.fr" = { + enableACME = true; + forceSSL = true; + serverAliases = [ ]; + locations."/".proxyPass = "http://localhost:3001/"; + }; +} diff --git a/machines/photo01/nginx.nix b/machines/photo01/nginx.nix new file mode 100644 index 0000000..b44aeaa --- /dev/null +++ b/machines/photo01/nginx.nix @@ -0,0 +1,10 @@ +{ + services.nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + clientMaxBodySize = "500m"; + }; +} diff --git a/machines/photo01/openssh.nix b/machines/photo01/openssh.nix new file mode 100644 index 0000000..5f4aeb2 --- /dev/null +++ b/machines/photo01/openssh.nix @@ -0,0 +1,8 @@ +{ + services.openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + }; + }; +} diff --git a/machines/photo01/photoprism.nix b/machines/photo01/photoprism.nix new file mode 100644 index 0000000..644e406 --- /dev/null +++ b/machines/photo01/photoprism.nix @@ -0,0 +1,54 @@ +{ pkgs, ... }: + +{ + services = { + photoprism = { + enable = true; + port = 2342; + settings = { + PHOTOPRISM_DEFAULT_LOCALE = "fr"; + PHOTOPRISM_ADMIN_USERNAME = "admin"; + PHOHOPRISM_SITE_URL = "https://photoprism.cgiga.fr"; + PHOTOPRISM_SITE_CAPTION = "PhotoPrism"; + + # DB access config + PHOTOPRISM_DATABASE_DRIVER = "mysql"; + PHOTOPRISM_DATABASE_NAME = "photoprism"; + PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock"; + PHOTOPRISM_DATABASE_USER = "photoprism"; + }; + + originalsPath = "/data/photos"; + + address = "localhost"; + + #importPath = "/photoprism/imports"; + passwordFile = "/passwords/photoprism"; + }; + + mysql = { + enable = true; + dataDir = "/data/mysql"; + package = pkgs.mariadb; + ensureDatabases = [ "photoprism" ]; + ensureUsers = [ + { + name = "photoprism"; + ensurePermissions = { + "photoprism.*" = "ALL PRIVILEGES"; + }; + } + ]; + }; + + nginx.virtualHosts."photoprism.cgiga.fr" = { + enableACME = true; + forceSSL = true; + serverAliases = [ ]; + locations."/" = { + proxyPass = "http://localhost:2342/"; + proxyWebsockets = true; + }; + }; + }; +} diff --git a/machines/photo01/secrets/secrets.nix b/machines/photo01/secrets/secrets.nix new file mode 100644 index 0000000..4f61be6 --- /dev/null +++ b/machines/photo01/secrets/secrets.nix @@ -0,0 +1,3 @@ +(import ../../../keys).mkSecrets [ "photo01" ] [ + # List of secrets for router02 +] diff --git a/meta/network.nix b/meta/network.nix index 61e8875..ca31c69 100644 --- a/meta/network.nix +++ b/meta/network.nix @@ -49,4 +49,11 @@ hostId = "144d0f7a"; }; + photo01 = { + interfaces = { }; + + addresses.ipv4 = [ "129.199.146.101" ]; + + hostId = "bcf8ff03"; + }; } diff --git a/meta/nodes.nix b/meta/nodes.nix index 1479f4e..f3fca44 100644 --- a/meta/nodes.nix +++ b/meta/nodes.nix @@ -19,7 +19,6 @@ - luj01 -> VM de Luj */ { - krz01 = { site = "pav01"; @@ -36,6 +35,15 @@ stateVersion = "24.05"; nixpkgs = "24.05"; }; + photo01 = { + site = "pav01"; + + # TODO + hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A"; + + stateVersion = "24.05"; + nixpkgs = "unstable"; + }; router02 = { site = "pav01";