-
-
Notifications
You must be signed in to change notification settings - Fork 14.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
18 changed files
with
325 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10152,6 +10152,12 @@ | |
| githubId = 45084216; | ||
| keys = [ { fingerprint = "1BF9 8D10 E0D0 0B41 5723 5836 4C13 3A84 E646 9228"; } ]; | ||
| }; | ||
| jaculabilis = { | ||
| name = "Tim Van Baak"; | ||
| email = "[email protected]"; | ||
| github = "Jaculabilis"; | ||
| githubId = 10787844; | ||
| }; | ||
| jaduff = { | ||
| email = "[email protected]"; | ||
| github = "jaduff"; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| { | ||
| config, | ||
| lib, | ||
| pkgs, | ||
| ... | ||
| }: | ||
| let | ||
| cfg = config.services.immich-public-proxy; | ||
| format = pkgs.formats.json { }; | ||
| inherit (lib) | ||
| types | ||
| mkIf | ||
| mkOption | ||
| mkEnableOption | ||
| ; | ||
| in | ||
| { | ||
| options.services.immich-public-proxy = { | ||
| enable = mkEnableOption "Immich Public Proxy"; | ||
| package = lib.mkPackageOption pkgs "immich-public-proxy" { }; | ||
|
|
||
| immichUrl = mkOption { | ||
| type = types.str; | ||
| description = "URL of the Immich instance"; | ||
| }; | ||
|
|
||
| port = mkOption { | ||
| type = types.port; | ||
| default = 3000; | ||
| description = "The port that IPP will listen on."; | ||
| }; | ||
| openFirewall = mkOption { | ||
| type = types.bool; | ||
| default = false; | ||
| description = "Whether to open the IPP port in the firewall"; | ||
| }; | ||
|
|
||
| settings = mkOption { | ||
| type = types.submodule { | ||
| freeformType = format.type; | ||
| }; | ||
| default = { }; | ||
| description = '' | ||
| Configuration for IPP. See <https://github.com/alangrainger/immich-public-proxy/blob/main/README.md#additional-configuration> for options and defaults. | ||
| ''; | ||
| }; | ||
| }; | ||
|
|
||
| config = mkIf cfg.enable { | ||
| systemd.services.immich-public-proxy = { | ||
| description = "Immich public proxy for sharing albums publicly without exposing your Immich instance"; | ||
| after = [ "network.target" ]; | ||
| wantedBy = [ "multi-user.target" ]; | ||
| environment = { | ||
| IMMICH_URL = cfg.immichUrl; | ||
| IPP_PORT = builtins.toString cfg.port; | ||
| IPP_CONFIG = "${format.generate "config.json" cfg.settings}"; | ||
| }; | ||
| serviceConfig = { | ||
| ExecStart = lib.getExe cfg.package; | ||
| SyslogIdentifier = "ipp"; | ||
| User = "ipp"; | ||
| Group = "ipp"; | ||
| DynamicUser = true; | ||
| Type = "simple"; | ||
| Restart = "on-failure"; | ||
| RestartSec = 3; | ||
|
|
||
| # Hardening | ||
| CapabilityBoundingSet = ""; | ||
| NoNewPrivileges = true; | ||
| PrivateUsers = true; | ||
| PrivateTmp = true; | ||
| PrivateDevices = true; | ||
| PrivateMounts = true; | ||
| ProtectClock = true; | ||
| ProtectControlGroups = true; | ||
| ProtectHome = true; | ||
| ProtectHostname = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| RestrictAddressFamilies = [ | ||
| "AF_INET" | ||
| "AF_INET6" | ||
| "AF_UNIX" | ||
| ]; | ||
| RestrictNamespaces = true; | ||
| RestrictRealtime = true; | ||
| RestrictSUIDSGID = true; | ||
| }; | ||
| }; | ||
|
|
||
| networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; | ||
|
|
||
| meta.maintainers = with lib.maintainers; [ jaculabilis ]; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| import ../make-test-python.nix ( | ||
| { pkgs, lib, ... }: | ||
| { | ||
| name = "immich-public-proxy"; | ||
|
|
||
| nodes.machine = | ||
| { pkgs, ... }@args: | ||
| { | ||
| environment.systemPackages = [ | ||
| pkgs.imagemagick | ||
| pkgs.immich-cli | ||
| ]; | ||
| services.immich = { | ||
| enable = true; | ||
| port = 2283; | ||
| # disable a lot of features that aren't needed for this test | ||
| machine-learning.enable = false; | ||
| settings = { | ||
| backup.database.enabled = false; | ||
| machineLearning.enabled = false; | ||
| map.enabled = false; | ||
| reverseGeocoding.enabled = false; | ||
| metadata.faces.import = false; | ||
| newVersionCheck.enabled = false; | ||
| notifications.smtp.enabled = false; | ||
| }; | ||
| }; | ||
| services.immich-public-proxy = { | ||
| enable = true; | ||
| immichUrl = "http://localhost:2283"; | ||
| port = 8002; | ||
| settings.ipp.responseHeaders."X-NixOS" = "Rules"; | ||
| }; | ||
| }; | ||
|
|
||
| testScript = '' | ||
| import json | ||
| machine.wait_for_unit("immich-server.service") | ||
| machine.wait_for_unit("immich-public-proxy.service") | ||
| machine.wait_for_open_port(2283) | ||
| machine.wait_for_open_port(8002) | ||
| # The proxy should be up | ||
| machine.succeed("curl -sf http://localhost:8002") | ||
| # Verify the static assets are served | ||
| machine.succeed("curl -sf http://localhost:8002/robots.txt") | ||
| machine.succeed("curl -sf http://localhost:8002/share/static/style.css") | ||
| # Check that the response header in the settings is sent | ||
| res = machine.succeed(""" | ||
| curl -sD - http://localhost:8002 -o /dev/null | ||
| """) | ||
| assert "x-nixos: rules" in res.lower(), res | ||
| # Log in to Immich and create an access key | ||
| machine.succeed(""" | ||
| curl -sf --json '{ "email": "[email protected]", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up | ||
| """) | ||
| res = machine.succeed(""" | ||
| curl -sf --json '{ "email": "[email protected]", "password": "admin" }' http://localhost:2283/api/auth/login | ||
| """) | ||
| token = json.loads(res)['accessToken'] | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys | ||
| """ % token) | ||
| key = json.loads(res)['secret'] | ||
| machine.succeed(f"immich login http://localhost:2283/api {key}") | ||
| res = machine.succeed("immich server-info") | ||
| print(res) | ||
| # Upload some blank images to a new album | ||
| # If there's only one image, the proxy serves the image directly | ||
| machine.succeed("magick -size 800x600 canvas:white /tmp/white.png") | ||
| machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/white.png") | ||
| machine.succeed("magick -size 800x600 canvas:black /tmp/black.png") | ||
| machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/black.png") | ||
| res = machine.succeed("immich server-info") | ||
| print(res) | ||
| # Get the new album id | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/albums | ||
| """ % token) | ||
| album_id = json.loads(res)[0]['id'] | ||
| # Create a shared link | ||
| res = machine.succeed(""" | ||
| curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "albumId": "%s", "type": "ALBUM" }' http://localhost:2283/api/shared-links | ||
| """ % (token, album_id)) | ||
| share_key = json.loads(res)['key'] | ||
| # Access the share | ||
| machine.succeed(""" | ||
| curl -sf http://localhost:2283/share/%s | ||
| """ % share_key) | ||
| # Access the share through the proxy | ||
| machine.succeed(""" | ||
| curl -sf http://localhost:8002/share/%s | ||
| """ % share_key) | ||
| ''; | ||
| } | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
Oops, something went wrong.