diff --git a/active/podman_immich/compose/README.md b/active/podman_immich/compose/README.md new file mode 100644 index 0000000..54893f3 --- /dev/null +++ b/active/podman_immich/compose/README.md @@ -0,0 +1,3 @@ +# Compose + +Put your compose.yaml here. diff --git a/active/podman_immich/compose/compose.yaml b/active/podman_immich/compose/compose.yaml new file mode 100644 index 0000000..22062e4 --- /dev/null +++ b/active/podman_immich/compose/compose.yaml @@ -0,0 +1,79 @@ +# +# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose +# +# Make sure to use the docker-compose.yml of the current release: +# +# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml +# +# The compose file on main may not be compatible with the latest release. + +services: + immich-server: + container_name: immich_server + image: ghcr.io/immich-app/immich-server:release + # extends: + # file: hwaccel.transcoding.yml + # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding + volumes: + - /home/immich/library:/data:Z + - /etc/localtime:/etc/localtime:ro + env_file: + - .env + ports: + - '2283:2283' + depends_on: + - redis + - database + restart: always + healthcheck: + disable: false + networks: + - immich + + immich-machine-learning: + container_name: immich_machine_learning + # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag. + # Example tag: release-cuda + image: ghcr.io/immich-app/immich-machine-learning:release + # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration + # file: hwaccel.ml.yml + # service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable + volumes: + - /home/immich/model-cache:/cache:Z + env_file: + - .env + restart: always + healthcheck: + disable: false + networks: + - immich + + redis: + container_name: immich_redis + image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571 + healthcheck: + test: redis-cli ping || exit 1 + restart: always + networks: + - immich + + database: + container_name: immich_postgres + image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:c44be5f2871c59362966d71eab4268170eb6f5653c0e6170184e72b38ffdf107 + environment: + POSTGRES_PASSWORD: postgres + POSTGRES_USER: postgres + POSTGRES_DB: immich + POSTGRES_INITDB_ARGS: '--data-checksums' + # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs + # DB_STORAGE_TYPE: 'HDD' + volumes: + - /home/immich/postgres:/var/lib/postgresql/data:Z + shm_size: 128mb + restart: always + networks: + - immich + +networks: + immich: + enable_ipv6: true \ No newline at end of file diff --git a/active/podman_immich/immich.md b/active/podman_immich/immich.md new file mode 100644 index 0000000..70422bc --- /dev/null +++ b/active/podman_immich/immich.md @@ -0,0 +1,174 @@ +# Podman immich + +- [Podman immich](#podman-immich) + - [Setup immich Project](#setup-immich-project) + - [Install immich](#install-immich) + - [Create the immich user](#create-the-immich-user) + - [Write the immich compose spec](#write-the-immich-compose-spec) + - [A Note on Volumes](#a-note-on-volumes) + - [Convert immich compose spec to quadlets](#convert-immich-compose-spec-to-quadlets) + - [Create any container-mounted directories](#create-any-container-mounted-directories) + - [Start and enable your systemd quadlet](#start-and-enable-your-systemd-quadlet) + - [Expose immich](#expose-immich) + - [firewalld](#firewalld) + - [Backup immich](#backup-immich) + - [Upgrade immich](#upgrade-immich) + - [Upgrade Quadlets](#upgrade-quadlets) + - [Uninstall](#uninstall) + - [Notes](#notes) + - [SELinux](#selinux) + +## Setup immich Project + +- [x] Copy and rename this folder to active/podman_immich +- [x] Find and replace immich with the name of the service. +- [x] Create the rootless user to run the podman containers +- [ ] Write the compose.yaml spec for your service +- [ ] Convert the compose.yaml spec to a quadlet +- [ ] Install the quadlet on the podman server +- [ ] Expose the quadlet service +- [ ] Install a backup service and timer + +## Install immich + +### Create the immich user + +```bash +# SSH into your podman server as root +useradd immich +loginctl enable-linger $(id -u immich) +systemctl --user --machine=immich@.host enable podman-restart +systemctl --user --machine=immich@.host enable --now podman.socket +mkdir -p /home/immich/.config/containers/systemd +``` + +### Write the immich compose spec + +1. Pull down the immich files + + ```bash + # Pull the compose file + wget -O active/podman_immich/compose/compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml + + # Pull the .env file + wget -O active/podman_immich/quadlets/.env https://github.com/immich-app/immich/releases/latest/download/example.env + ``` + +2. Edit the compose.yaml. Replace all environment variables with their correct values. +3. Edit the .env file. Make sure to match exactly what is in the compose file. + +#### A Note on Volumes + +Named volumes are stored at `/home/immich/.local/share/containers/storage/volumes/`. + +### Convert immich compose spec to quadlets + +Run the following to convert a compose.yaml into the various `.container` files for systemd: + +```bash +# Generate the systemd service +podman run \ +--security-opt label=disable \ +--rm \ +-v $(pwd)/active/podman_immich/compose:/compose \ +-v $(pwd)/active/podman_immich/quadlets:/quadlets \ +quay.io/k9withabone/podlet \ +-f /quadlets \ +-i \ +--overwrite \ +compose /compose/compose.yaml + +# Copy the files to the server +export PODMAN_SERVER= +scp -r active/podman_immich/quadlets/. $PODMAN_SERVER:/home/immich/.config/containers/systemd/ +ssh $PODMAN_SERVER chown -R immich:immich /home/immich/.config/containers/systemd/ +``` + +### Create any container-mounted directories + +SSH into your podman server as root: + +```bash +machinectl shell immich@ +podman unshare +mkdir library postgres model-cache +``` + +### Start and enable your systemd quadlet + +SSH into your podman server as root: + +```bash +machinectl shell immich@ +systemctl --user daemon-reload +systemctl --user restart immich-server.service immich-machine-learning.service +# Enable auto-update service which will pull new container images automatically every day +systemctl --user enable --now podman-auto-update.timer +``` + +### Expose immich + +1. If you need a domain, follow the [DDNS instructions](/active/podman_ddns/ddns.md#install-a-new-ddns-service) +2. For a web service, follow the [Caddy instructions](/active/podman_caddy/caddy.md#adding-a-new-caddy-record) +3. Finally, follow your OS's guide for opening ports via its firewall service. + +#### firewalld + +```bash +# command to get current active zone and default zone +firewall-cmd --get-active-zones +firewall-cmd --get-default-zone + +# command to open 443 on tcp +firewall-cmd --permanent --zone= --add-port=443/tcp + +# command to open 80 and 443 on tcp and udp +firewall-cmd --permanent --zone= --add-port={80,443}/{tcp,udp} + +# command to list available services and then open http and https +firewall-cmd --get-services +firewall-cmd --permanent --zone= --add-service={http,https} +``` + +## Backup immich + +Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup) + +## Upgrade immich + +### Upgrade Quadlets + +Upgrades should be a repeat of [writing the compose spec](#convert-immich-compose-spec-to-quadlets) and [installing the quadlets](#start-and-enable-your-systemd-quadlet) + +```bash +export PODMAN_SERVER= +scp -r quadlets/. $PODMAN_SERVER$:/home/immich/.config/containers/systemd/ +ssh immich systemctl --user daemon-reload +ssh immich systemctl --user restart immich +``` + +## Uninstall + +```bash +# Stop the user's services +systemctl --user disable podman-restart +podman container stop --all +systemctl --user disable --now podman.socket +systemctl --user disable --now podman-auto-update.timer + +# Delete the user (this won't delete their home directory) +# userdel might spit out an error like: +# userdel: user immich is currently used by process 591255 +# kill those processes and try again +userdel immich +``` + +## Notes + +### SELinux + + + +:z allows a container to share a mounted volume with all other containers. + +:Z allows a container to reserve a mounted volume and prevents any other container from accessing. diff --git a/active/podman_immich/quadlets/.env b/active/podman_immich/quadlets/.env new file mode 100644 index 0000000..ce6be95 --- /dev/null +++ b/active/podman_immich/quadlets/.env @@ -0,0 +1,26 @@ +# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables + +# The location where your uploaded files are stored +UPLOAD_LOCATION=/home/immich/library + +# The location where your database files are stored. Network shares are not supported for the database +DB_DATA_LOCATION=/home/immich/postgres + +# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List +TZ=Etc/EST + +# The Immich version to use. You can pin this to a specific version like "v1.71.0" +IMMICH_VERSION=release + +# Connection secret for postgres. You should change it to a random password +# Please use only the characters `A-Za-z0-9`, without special characters or spaces +DB_PASSWORD=postgres + +# The values below this line do not need to be changed +################################################################################### +DB_USERNAME=postgres +DB_DATABASE_NAME=immich + +# Should match the container_name fields in the compose.yaml +REDIS_HOSTNAME=immich_redis +DB_HOSTNAME=immich_postgres diff --git a/active/podman_immich/quadlets/README.md b/active/podman_immich/quadlets/README.md new file mode 100644 index 0000000..0ea23f9 --- /dev/null +++ b/active/podman_immich/quadlets/README.md @@ -0,0 +1,3 @@ +# Quadlets + +Put your quadlets here. diff --git a/active/podman_immich/quadlets/database.container b/active/podman_immich/quadlets/database.container new file mode 100644 index 0000000..e7c9294 --- /dev/null +++ b/active/podman_immich/quadlets/database.container @@ -0,0 +1,13 @@ +[Container] +ContainerName=immich_postgres +Environment=POSTGRES_PASSWORD=postgres POSTGRES_USER=postgres POSTGRES_DB=immich POSTGRES_INITDB_ARGS=--data-checksums +Image=ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:c44be5f2871c59362966d71eab4268170eb6f5653c0e6170184e72b38ffdf107 +Network=immich.network +ShmSize=128mb +Volume=/home/immich/postgres:/var/lib/postgresql/data:Z + +[Service] +Restart=always + +[Install] +WantedBy=default.target diff --git a/active/podman_immich/quadlets/immich-machine-learning.container b/active/podman_immich/quadlets/immich-machine-learning.container new file mode 100644 index 0000000..60e1d15 --- /dev/null +++ b/active/podman_immich/quadlets/immich-machine-learning.container @@ -0,0 +1,12 @@ +[Container] +ContainerName=immich_machine_learning +EnvironmentFile=.env +Image=ghcr.io/immich-app/immich-machine-learning:release +Network=immich.network +Volume=/home/immich/model-cache:/cache:Z + +[Service] +Restart=always + +[Install] +WantedBy=default.target diff --git a/active/podman_immich/quadlets/immich-server.container b/active/podman_immich/quadlets/immich-server.container new file mode 100644 index 0000000..0787fce --- /dev/null +++ b/active/podman_immich/quadlets/immich-server.container @@ -0,0 +1,17 @@ +[Unit] +Requires=redis.service database.service + +[Container] +ContainerName=immich_server +EnvironmentFile=.env +Image=ghcr.io/immich-app/immich-server:release +Network=immich.network +PublishPort=2283:2283 +Volume=/home/immich/library:/data:Z +Volume=/etc/localtime:/etc/localtime:ro + +[Service] +Restart=always + +[Install] +WantedBy=default.target diff --git a/active/podman_immich/quadlets/immich.network b/active/podman_immich/quadlets/immich.network new file mode 100644 index 0000000..36a0dcd --- /dev/null +++ b/active/podman_immich/quadlets/immich.network @@ -0,0 +1,5 @@ +[Network] +IPv6=true + +[Install] +WantedBy=default.target diff --git a/active/podman_immich/quadlets/redis.container b/active/podman_immich/quadlets/redis.container new file mode 100644 index 0000000..90f4c7e --- /dev/null +++ b/active/podman_immich/quadlets/redis.container @@ -0,0 +1,11 @@ +[Container] +ContainerName=immich_redis +HealthCmd=redis-cli ping || exit 1 +Image=docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571 +Network=immich.network + +[Service] +Restart=always + +[Install] +WantedBy=default.target