Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
84 lines
3.5 KiB
YAML
84 lines
3.5 KiB
YAML
---
|
|
# Immich version to deploy
|
|
immich_version: release
|
|
|
|
# Storage location (@see https://docs.immich.app/install/environment-variables/)
|
|
immich_upload_location: "{{ podman_projects_dir }}/immich/data/upload"
|
|
|
|
# Backup manifest - original photos/videos (the irreplaceable data). The
|
|
# PostgreSQL side is covered by the `postgres: all` job in the inventory.
|
|
immich_backup_paths:
|
|
- "{{ immich_upload_location }}"
|
|
|
|
# Regenerable derivatives. Immich rebuilds these on demand (Generate
|
|
# Thumbnails / Transcode Videos jobs), and they are many small files that
|
|
# dominate S3 request count - exclude them for restore value.
|
|
immich_backup_exclude:
|
|
- "{{ immich_upload_location }}/thumbs"
|
|
- "{{ immich_upload_location }}/encoded-video"
|
|
|
|
# External libraries (read-only host paths exposed to the server container)
|
|
# Use the in-container `mount_path` when registering the library in the Immich UI.
|
|
# Example:
|
|
# immich_external_libraries:
|
|
# - name: clement-photos
|
|
# host_path: /mnt/andromeda/clement-photos
|
|
# mount_path: /mnt/external/clement-photos
|
|
immich_external_libraries: []
|
|
|
|
# PostgreSQL configuration (REQUIRED password - must be set explicitly)
|
|
immich_postgres_db_name: immich
|
|
immich_postgres_user: immich
|
|
# immich_postgres_password: "" # Intentionally undefined - role will fail if not set
|
|
# immich_postgres_host: "" # Must be set in inventory (e.g., "{{ podman_gw_gateway }}" to reach host postgres)
|
|
immich_postgres_port: 5432
|
|
|
|
# Valkey configuration (REQUIRED password - must be set explicitly)
|
|
immich_valkey_user: immich
|
|
# immich_valkey_password: "" # Intentionally undefined - role will fail if not set
|
|
# immich_valkey_host: "" # Must be set in inventory (e.g., "{{ podman_gw_gateway }}" to reach host valkey)
|
|
immich_valkey_port: 6379
|
|
immich_valkey_db: 0 # Dedicated database number for isolation (0-15)
|
|
|
|
# Valkey ACL configuration
|
|
# Based on: https://github.com/immich-app/immich/discussions/19727#discussioncomment-13668749
|
|
immich_valkey_acl:
|
|
username: "{{ immich_valkey_user }}"
|
|
password: "{{ immich_valkey_password }}"
|
|
keypattern: "immich_bull* immich_channel*" # BullMQ patterns used by Immich
|
|
commands: "&* -@dangerous +@read +@write +@pubsub +select +auth +ping +info +eval +evalsha"
|
|
# &* = all channels (required for pub/sub)
|
|
# -@dangerous = deny dangerous commands (FLUSHDB, FLUSHALL, KEYS, etc)
|
|
# +@read +@write = allow read/write command groups
|
|
# +@pubsub = allow pub/sub commands
|
|
# +select = allow SELECT (database switching)
|
|
# +auth +ping +info = connection management
|
|
# +eval +evalsha = Lua scripting (required by BullMQ)
|
|
|
|
# Network configuration
|
|
immich_port: 2283
|
|
|
|
# Container images
|
|
immich_server_image: ghcr.io/immich-app/immich-server
|
|
immich_ml_image: ghcr.io/immich-app/immich-machine-learning
|
|
|
|
# Timezone
|
|
immich_timezone: UTC
|
|
|
|
# Nginx reverse proxy configuration
|
|
immich_nginx_enabled: false
|
|
immich_nginx_hostname: photos.nas.local
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
immich_nginx_letsencrypt: false
|
|
immich_nginx_ssl_certificate: >-
|
|
{{ immich_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
immich_nginx_ssl_certificate_key: >-
|
|
{{ immich_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|