Whether to enable selfhostblocks.immich.

Type: boolean

Default:

false

Example:

true

Declared by:

Hardware acceleration devices for Immich. Set to null to allow access to all devices. Set to empty list to disable hardware acceleration.

Type: null or (list of absolute path)

Default:

null

Example:

[
  "/dev/dri"
]

Declared by:

Backup configuration for Immich media files and database.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  "*.tmp"
  "cache/*"
  "encoded-video/*"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/immich"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"immich"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.immich.subdomain}.\${config.shb.immich.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:2283"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Set to true to enable debug logging.

Type: boolean

Default:

false

Example:

true

Declared by:

Domain under which Immich is served.

<subdomain>.<domain>

Type: string

Example:

"example.com"

Declared by:

Declaratively create an admin.

If set, this means the admin user will be created when Immich server starts. If the admin already exists, nothing will be done.

This does not skip onboarding unless you set shb.immich.skipOnboarding to true.

Type: null or (submodule)

Default:

null

Declared by:

Initial email of declaratively setup admin.

Subsequent changes in the UI will override this value. Also, changing this value will not update the actual email.

Type: string

Declared by:

Initial name of declaratively setup admin.

Subsequent changes in the UI will override this value. Also, changing this value will not update the actual name.

Type: string

Declared by:

Initial password of declaratively setup admin.

Subsequent changes in the UI will override this value. Also, changing this value will not update the actual password.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"immich"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "immich-server.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

File containing Immich’s JWT secret key for sessions. This is required for secure session management.

Type: null or (submodule)

Default:

null

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"immich"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "immich-server.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

Machine learning configuration.

Type: submodule

Default:

{ }

Declared by:

Enable machine learning features.

Type: boolean

Default:

true

Declared by:

Extra environment variables for machine learning service.

Type: attribute set of string

Default:

{ }

Example:

{
  MACHINE_LEARNING_WORKERS = "2";
  MACHINE_LEARNING_WORKER_TIMEOUT = "180";
}

Declared by:

Directory where Immich will store media files.

Type: string

Default:

"/var/lib/immich"

Declared by:

Set to true to allow Immich to phone home so it can check if a new version is available.

In the spirit of not sending any telemetry by default, this option is set to false by default.

Type: boolean

Default:

false

Declared by:

Port under which Immich will listen.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

2283

Declared by:

Enable Immich Public Proxy service for sharing media publically.

Type: boolean

Default:

false

Declared by:

Port under which Immich Public Proxy will listen.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

2284

Declared by:

Immich configuration settings. Only specify settings that you want SHB to manage declaratively. Other settings can be configured through Immich’s admin UI.

See https://immich.app/docs/install/config-file/ for available options.

Type: attribute set

Default:

{ }

Example:

{
  ffmpeg = {
    crf = 23;
  };
  job = {
    backgroundTask = {
      concurrency = 5;
    };
  };
  storageTemplate = {
    enabled = true;
    template = "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}";
  };
}

Declared by:

This allows you to skip onboarding.

If set to true, you are required to fill out the shb.immich.admin options.

Type: boolean

Default:

false

Declared by:

SMTP configuration for sending notifications.

Type: null or (submodule)

Default:

null

Declared by:

SMTP address from which the emails originate.

Type: string

Example:

"noreply@example.com"

Declared by:

SMTP host to send the emails to.

Type: string

Example:

"smtp.example.com"

Declared by:

Ignore TLS certificate errors.

Type: boolean

Default:

false

Declared by:

File containing the password to connect to the SMTP host.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"immich"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "immich-server.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

SMTP port to send the emails to.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

587

Declared by:

Reply-to address for emails.

Type: string

Example:

"support@example.com"

Declared by:

Use secure connection (SSL/TLS).

Type: boolean

Default:

false

Declared by:

Username to connect to the SMTP host.

Type: string

Example:

"smtp-user"

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Setup SSO integration.

Type: submodule

Default:

{ }

Declared by:

Whether to enable SSO integration…

Type: boolean

Default:

false

Example:

true

Declared by:

OIDC admin group

Type: string

Default:

"immich_admin"

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default:

"one_factor"

Declared by:

Automatically redirect to SSO provider.

Type: boolean

Default:

true

Declared by:

Automatically register new users from SSO provider.

Type: boolean

Default:

true

Declared by:

Text to display on the SSO login button.

Type: string

Default:

"Login with SSO"

Declared by:

Client ID for the OIDC endpoint.

Type: string

Default:

"immich"

Declared by:

OIDC endpoint for SSO.

Type: string

Example:

"https://authelia.example.com"

Declared by:

Enable password login.

Type: boolean

Default:

true

Declared by:

If given, adds a port to the endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by:

OIDC provider name, used for display.

Type: one of “Authelia”, “Keycloak”, “Generic”

Default:

"Authelia"

Declared by:

OIDC shared secret for Immich.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"immich"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"immich"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "immich-server.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

OIDC shared secret for Authelia. Content must be the same as sharedSecret option.

Type: submodule

Default:

null

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[ ]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

Claim to use for user storage label.

Type: string

Default:

"preferred_username"

Declared by:

OIDC user group

Type: string

Default:

"immich_user"

Declared by:

Subdomain under which Immich will be served.

<subdomain>.<domain>

Type: string

Example:

"photos"

Declared by: