feat: add module for immich service

Signed-off-by: Chinmay D. Pai <chinmaydpai@gmail.com>

flake.lock

@@ -693,6 +693,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-immich": {
+      "locked": {
+        "lastModified": 1727171772,
+        "narHash": "sha256-6T0ctDFq0lepqjViL8TVw4RhpkHIUyoNWzPgTjPamZo=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d026e3fa1ad0d78d9072d9afdeae515d2d68acae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d026e3fa1ad0d78d9072d9afdeae515d2d68acae",
+        "type": "github"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1726362065,
@@ -795,6 +811,7 @@
         "nil": "nil",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
+        "nixpkgs-immich": "nixpkgs-immich",
         "nur": "nur",
         "snowfall-lib": "snowfall-lib",
         "srvos": "srvos",

flake.nix

@@ -101,6 +101,7 @@
     nil.inputs.nixpkgs.follows = "nixpkgs";
 
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-immich.url = "github:nixos/nixpkgs/d026e3fa1ad0d78d9072d9afdeae515d2d68acae";
     nixos-hardware.url = "github:nixos/nixos-hardware";
 
     nur.url = "github:nix-community/nur";

modules/nixos/services/immich/default.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  ...
+}: {
+  imports = [
+    "${inputs.nixpkgs-immich}/nixos/modules/services/web-apps/immich.nix"
+  ];
+
+  options.snowflake.services.immich = {
+    enable = lib.mkEnableOption "Enable immich service";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = "Configuration domain to use for the immich service";
+    };
+  };
+
+  config = let
+    cfg = config.snowflake.services.immich;
+  in
+    lib.mkIf cfg.enable {
+      services.immich = {
+        enable = true;
+        package = inputs.nixpkgs-immich.legacyPackages.x86_64-linux.immich;
+        mediaLocation = "/storage/media/immich-library";
+        port = 9121;
+      };
+
+      users.users.immich.extraGroups = ["media" "video" "render"];
+
+      # Requires services.nginx.enable.
+      services.nginx = {
+        virtualHosts = {
+          "${cfg.domain}" = {
+            serverName = "${cfg.domain}";
+            enableACME = true;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://${config.services.immich.host}:${toString config.services.immich.port}/";
+              proxyWebsockets = true;
+            };
+            extraConfig = ''
+              client_max_body_size 0;
+              proxy_connect_timeout 600;
+              proxy_read_timeout 600;
+              proxy_send_timeout 600;
+            '';
+          };
+        };
+      };
+    };
+}

systems/x86_64-linux/bicboye/default.nix

@@ -128,6 +128,11 @@
         dbPasswordFile = userdata.secrets.services.gitea.password;
       };
 
+      immich = {
+        enable = true;
+        domain = "photos.deku.moe";
+      };
+
       miniflux = {
         enable = true;
         domain = "flux.deku.moe";