immich distributed video transcoding

master.nix

{
  services.immich.enable = true;
  services.immich.host = "0.0.0.0";
  services.immich.openFirewall = true;
  services.immich.mediaLocation = "/pool1/data1/immich/media";
  services.immich.machine-learning.enable = false;
  services.immich.settings.machineLearning.urls = [ "http://10.244.202.182:3003" ];
  services.immich.redis.host = "0.0.0.0";
  services.immich.redis.port = 6379;
  services.immich.database.host = "0.0.0.0";
  services.immich.database.port = 5432;
  services.immich.environment.IMMICH_WORKERS_INCLUDE = "api";
  # don't forget to manually insert password for user immich using psql cli
  services.immich.secretsFile = builtins.toString (pkgs.writeText "immich-secrets" ''
    DB_PASSWORD=password
  ''
  );
  services.postgresql.enableTCPIP = true;
  services.postgresql.authentication = lib.mkOverride 10 ''
    #type database DBuser origin-address auth-method
    local all      all    peer
    # ipv4
    host  all      all    127.0.0.1/32   password
    host  all      all    10.0.0.0/0     password
    host  all      all    192.168.0.0/16 password
    # ipv6
    host  all      all    ::1/128        password
  '';
  networking.firewall.allowedTCPPorts = [ 6379 5432 ];

}

worker.nix

{

  # immich distributed video transcoding
  # mount with `sshfs server:/pool1/data1 /pool1/data1`
  
  services.immich.enable = true;
  services.immich.host = "0.0.0.0";
  services.immich.database.enable = false;
  services.immich.machine-learning.environment.IMMICH_HOST = lib.mkForce "0.0.0.0";
  services.immich.redis.enable = false;
  services.immich.redis.host = "10.244.32.193";
  services.immich.redis.port = 6379;
  services.immich.database.host = "10.244.32.193";
  services.immich.database.port = 5412;
  services.immich.environment.IMMICH_WORKERS_INCLUDE = "microservices";
  services.immich.environment.UPLOAD_LOCATION = "/pool1/data1/immich/media";
  services.immich.environment.WORKDIR = "/pool1/data1/immich";
  services.immich.user = "aabccd021";
  services.immich.secretsFile = builtins.toString (pkgs.writeText "immich-secrets" ''
    DB_PASSWORD=password
  '');
  systemd.services.immich-server.serviceConfig.PrivateDevices = lib.mkForce false;
  users.users.immich.extraGroups = [ "video" "render" ];
  networking.firewall.allowedTCPPorts = [ 3003 ];
  programs.fuse.userAllowOther = true;

}