machines/photo01/_configuration.nix

@@ -1,5 +1,5 @@
 # TODO: revamp to use the same framework as the other VMs
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
 
 let
   address = "129.199.146.101";
@@ -9,9 +9,8 @@ in
     ./_hardware-configuration.nix
 
     # NOTE: For now, only deploy the bare minimum
-    ./immich.nix
-    ./nginx.nix
     ./photoprism.nix
+    ./immich.nix
   ];
   deployment.targetHost = address;
 
@@ -34,6 +33,7 @@ in
   ];
 
   security.acme.acceptTerms = true;
+  security.acme.defaults.email = "webmaster@nixos.org";
 
   systemd.network = {
     config.routeTables = {
@@ -53,4 +53,29 @@ in
       };
     };
   };
+
+  # TODO: switch to unixsockets if supported
+
+  nix = {
+    settings = {
+      trusted-users = [
+        "@wheel"
+        "root"
+        "nix-ssh"
+      ];
+      auto-optimise-store = true;
+    };
+    #package = pkgs.nixUnstable;
+    extraOptions =
+      let
+        empty_registry = builtins.toFile "empty-flake-registry.json" ''{"flakes":[],"version":2}'';
+      in
+      ''
+        experimental-features = nix-command flakes
+        flake-registry = ${empty_registry}
+        builders-use-substitutes = true
+      '';
+    registry.nixpkgs.flake = inputs.nixpkgs;
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+  };
 }

machines/photo01/immich.nix

@@ -1,8 +1,7 @@
 {
   services.immich = {
     enable = true;
-    # NOTE: default port changes in a later version
-    port = 3001;
+    # default port: 3001
     machine-learning.enable = true;
     host = "localhost";
   };
@@ -11,6 +10,6 @@
     enableACME = true;
     forceSSL = true;
     serverAliases = [ ];
-    locations."/".proxyPass = "http://localhost:3001/";
+    locations."/".proxyPass = "http://localhost:2283/";
   };
 }