Add immich and dawarich container Nix configs; update default and flake

hosts/h001/containers/immich.nix

@@ -0,0 +1,230 @@
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  name = "immich";
+
+  # Data stored on the wd10 drive
+  hostDataDir = "/drives/wd10/immich";
+  # Var lib for postgres and other state
+  hostVarLibDir = "/var/lib/${name}";
+
+  hostAddress = "10.0.0.1";
+  containerAddress = "10.0.0.4";
+  hostAddress6 = "fc00::1";
+  containerAddress6 = "fc00::4";
+
+  immichNixpkgs = inputs.immich-nixpkgs;
+
+  # Secret file path (if using secrets)
+  hasSecret =
+    secret:
+    let
+      secrets = config.age.secrets or { };
+    in
+    secrets ? ${secret} && secrets.${secret} != null;
+
+  binds = [
+    # Postgres data, must use postgres user in container and host
+    {
+      host = "${hostVarLibDir}/postgres";
+      # Adjust based on container postgres data dir
+      container = "/var/lib/postgresql/17";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # Postgres backups
+    {
+      host = "${hostVarLibDir}/backups/postgres";
+      container = "/var/backup/postgresql";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # Immich media data on external drive
+    {
+      host = "${hostDataDir}/media";
+      container = "/var/lib/immich";
+      user = "immich";
+      uid = 916;
+      gid = 916;
+    }
+    # Immich machine learning cache
+    {
+      host = "${hostVarLibDir}/ml-cache";
+      container = "/var/cache/immich";
+      user = "immich";
+      uid = 916;
+      gid = 916;
+    }
+  ];
+
+  bindsWithUsers = lib.filter (b: b ? user) binds;
+  uniqueUsers = lib.foldl' (
+    acc: bind: if lib.lists.any (item: item.user == bind.user) acc then acc else acc ++ [ bind ]
+  ) [ ] bindsWithUsers;
+  users = {
+    users = lib.listToAttrs (
+      lib.map (u: {
+        name = u.user;
+        value = {
+          isSystemUser = true;
+          name = u.user;
+          uid = u.uid;
+          group = u.user;
+        };
+      }) uniqueUsers
+    );
+
+    groups = lib.listToAttrs (
+      lib.map (g: {
+        name = g.user;
+        value.gid = g.gid;
+      }) uniqueUsers
+    );
+  };
+in
+{
+  options = { };
+  config = {
+    services.nginx.virtualHosts."photos.joshuabell.xyz" = {
+      addSSL = true;
+      sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
+      sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
+      locations = {
+        "/" = {
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+          proxyPass = "http://${containerAddress}:2283";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-Proto https;
+            client_max_body_size 50G;
+          '';
+        };
+      };
+    };
+
+    # Ensure users exist on host machine
+    inherit users;
+
+    # Ensure directories exist on host machine
+    system.activationScripts."createDirsFor${name}" = ''
+      ${lib.concatStringsSep "\n" (
+        lib.map (bind: ''
+          mkdir -p ${bind.host}
+          chown -R ${toString bind.uid}:${toString bind.gid} ${bind.host}
+          chmod -R 750 ${bind.host}
+        '') bindsWithUsers
+      )}
+    '';
+
+    containers.${name} = {
+      ephemeral = true;
+      autoStart = true;
+      privateNetwork = true;
+      hostAddress = hostAddress;
+      localAddress = containerAddress;
+      hostAddress6 = hostAddress6;
+      localAddress6 = containerAddress6;
+      bindMounts = lib.foldl (
+        acc: bind:
+        {
+          "${bind.container}" = {
+            hostPath = bind.host;
+            isReadOnly = bind.readOnly or false;
+          };
+        }
+        // acc
+      ) { } binds;
+      nixpkgs = immichNixpkgs;
+      config =
+        {
+          config,
+          pkgs,
+          lib,
+          ...
+        }:
+        {
+          config = {
+            system.stateVersion = "25.05";
+
+            networking = {
+              firewall = {
+                enable = true;
+                allowedTCPPorts = [
+                  2283
+                ];
+              };
+              # Use systemd-resolved inside the container
+              # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+              useHostResolvConf = lib.mkForce false;
+            };
+            services.resolved.enable = true;
+
+            # Ensure users exist on container
+            inherit users;
+
+            services.postgresql = {
+              enable = true;
+              package = pkgs.postgresql_17.withPackages (ps: [ ps.pgvecto-rs ]);
+              enableJIT = true;
+              authentication = ''
+                local all all trust
+                host all all 127.0.0.1/8 trust
+                host all all ::1/128 trust
+                host all all fc00::1/128 trust
+              '';
+              ensureDatabases = [ "immich" ];
+              ensureUsers = [
+                {
+                  name = "immich";
+                  ensureDBOwnership = true;
+                  ensureClauses.login = true;
+                }
+              ];
+              settings = {
+                shared_preload_libraries = [ "vectors.so" ];
+              };
+            };
+
+            # Backup database
+            services.postgresqlBackup = {
+              enable = true;
+            };
+
+            services.immich = {
+              enable = true;
+              host = "0.0.0.0";
+              port = 2283;
+              openFirewall = true;
+              mediaLocation = "/var/lib/immich";
+              database = {
+                enable = true;
+                createDB = false; # We create it manually above
+                name = "immich";
+                user = "immich";
+              };
+              redis.enable = true;
+              machine-learning.enable = true;
+              settings = {
+                server.externalDomain = "https://photos.joshuabell.xyz";
+                newVersionCheck.enabled = false;
+              };
+            };
+
+            systemd.services.immich-server = {
+              requires = [ "postgresql.service" ];
+              after = [ "postgresql.service" ];
+            };
+
+            # Allow Immich user to access the media directory
+            users.users.immich.extraGroups = [ "video" "render" ];
+          };
+        };
+    };
+  };
+}