From 501428276987a5d600385e43767990a8c00ef8ef Mon Sep 17 00:00:00 2001 From: drmathias Date: Thu, 3 Oct 2024 22:52:55 +0100 Subject: [PATCH] Set up gateway, gitea & immich --- .gitignore | 3 + README.md | 9 ++ gateway/authelia/config/configuration.yml | 135 ++++++++++++++++++++++ gateway/caddy/Caddyfile | 46 ++++++++ gateway/cloudflare-ddns/config.json | 36 ++++++ gateway/dashboard/icons/gitea.svg | 31 +++++ gateway/dashboard/icons/immich.svg | 29 +++++ gateway/dashboard/index.html | 35 ++++++ gateway/dashboard/styles.css | 103 +++++++++++++++++ gateway/docker-compose.yml | 116 +++++++++++++++++++ gitea/docker-compose.yml | 54 +++++++++ immich/.env | 17 +++ immich/docker-compose.yml | 85 ++++++++++++++ immich/hwaccel.ml.yml | 43 +++++++ immich/hwaccel.transcoding.yml | 55 +++++++++ 15 files changed, 797 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 gateway/authelia/config/configuration.yml create mode 100644 gateway/caddy/Caddyfile create mode 100644 gateway/cloudflare-ddns/config.json create mode 100644 gateway/dashboard/icons/gitea.svg create mode 100644 gateway/dashboard/icons/immich.svg create mode 100644 gateway/dashboard/index.html create mode 100644 gateway/dashboard/styles.css create mode 100644 gateway/docker-compose.yml create mode 100644 gitea/docker-compose.yml create mode 100644 immich/.env create mode 100644 immich/docker-compose.yml create mode 100644 immich/hwaccel.ml.yml create mode 100644 immich/hwaccel.transcoding.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8db6258 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +**/data/** +**/secrets/** +.DS_Store \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..c3421ae --- /dev/null +++ b/README.md @@ -0,0 +1,9 @@ +# Homelab + +Configuration for the Homelab + +## Project Structure + +- Each folder contains an independently-runnable docker compose which comprises a logical grouping of services +- All volumes are placed under a folder `/data` +- All secrets are placed under a folder `/secrets` \ No newline at end of file diff --git a/gateway/authelia/config/configuration.yml b/gateway/authelia/config/configuration.yml new file mode 100644 index 0000000..4229345 --- /dev/null +++ b/gateway/authelia/config/configuration.yml @@ -0,0 +1,135 @@ +# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/ +# Set also AUTHELIA_JWT_SECRET_FILE +theme: auto + +# First Factor https://www.authelia.com/configuration/first-factor/file/ +authentication_backend: + file: + path: /config/data/users_database.yml + +# Second Factor https://www.authelia.com/configuration/second-factor/introduction/ +totp: + issuer: 64815139.xyz + +# Security https://www.authelia.com/configuration/security/access-control/ +access_control: + default_policy: "deny" + rules: + - domain: "*.64815139.xyz" + policy: "two_factor" + +# Session https://www.authelia.com/configuration/session/introduction/ +# Set also AUTHELIA_SESSION_SECRET_FILE +session: + cookies: + - domain: "64815139.xyz" + authelia_url: "https://auth.64815139.xyz" + + # https://www.authelia.com/configuration/session/redis/ + # Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate + redis: + host: redis + port: 6379 + +# Storage https://www.authelia.com/configuration/storage/postgres/ +# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE +# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE +storage: + postgres: + address: "tcp://postgres:5432" + database: "authelia" + username: "authelia" + +server: + endpoints: + authz: + forward-auth: + implementation: 'ForwardAuth' + +# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/ +# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE +notifier: + smtp: + address: "smtp://in-v3.mailjet.com:587" + username: '{{ secret "/run/secrets/SMTP_USERNAME" }}' + sender: "Authelia " + +identity_providers: + oidc: + jwks: + - key_id: "authelia" + algorithm: "RS256" + use: "sig" + certificate_chain: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_PEM" | mindent 10 "|" | msquote }} + key: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_CERT" | mindent 10 "|" | msquote }} + enable_client_debug_messages: false + minimum_parameter_entropy: 8 + enforce_pkce: "public_clients_only" + enable_pkce_plain_challenge: false + enable_jwt_access_token_stateless_introspection: false + discovery_signed_response_alg: "none" + discovery_signed_response_key_id: "" + require_pushed_authorization_requests: false + lifespans: + access_token: "1h" + authorize_code: "1m" + id_token: "1h" + refresh_token: "90m" + cors: + endpoints: + - "authorization" + - "token" + - "revocation" + - "introspection" + allowed_origins: + - "https://immich.64815139.xyz" + - "https://gitea.64815139.xyz" + allowed_origins_from_client_redirect_uris: false + clients: + - client_id: T0kYrFHTASAXGCV-rUOlQLDGsW0HFJRx_eAQ1dx9mo-vTgilubJMU46Ud1oRexmtZBjgAsEp + client_name: Gitea + client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }} + public: false + authorization_policy: 'two_factor' + consent_mode: pre-configured + token_endpoint_auth_method: 'client_secret_basic' + pre_configured_consent_duration: 1w + scopes: + - 'openid' + - 'email' + - 'profile' + redirect_uris: + - https://gitea.64815139.xyz/user/oauth2/Authelia/callback + - client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5 + client_name: Immich + client_secret: {{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }} + public: false + authorization_policy: two_factor + consent_mode: pre-configured + token_endpoint_auth_method: 'client_secret_basic' + pre_configured_consent_duration: 1w + scopes: + - openid + - groups + - email + - profile + - offline_access + redirect_uris: + - https://auth.64815139.xyz/ + - https://auth.64815139.xyz/oauth2/callback + - https://immich.64815139.xyz/oauth2/callback + - https://immich.64815139.xyz/auth/login + - https://immich.64815139.xyz/user-settings + - https://immich.64815139.xyz + - app.immich:/ + - app.immich:///oauth-callback + - https://immich.64815139.xyz/api/oauth/mobile-redirect + grant_types: + - refresh_token + - authorization_code + response_types: + - code + response_modes: + - form_post + - query + - fragment diff --git a/gateway/caddy/Caddyfile b/gateway/caddy/Caddyfile new file mode 100644 index 0000000..e77a5a5 --- /dev/null +++ b/gateway/caddy/Caddyfile @@ -0,0 +1,46 @@ +{ + servers { + trusted_proxies static private_ranges + trusted_proxies_strict + } +} + +(secure) { + header { + Cache-Control "no-cache, no-store, must-revalidate" + } + + forward_auth authelia:9091 { + uri /api/authz/forward-auth + copy_headers Remote-User Remote-Groups Remote-Name Remote-Email + } +} + +auth.64815139.xyz { + reverse_proxy authelia:9091 +} + +www.64815139.xyz { + import secure * + + root * /var/www/dashboard + encode gzip + file_server + + log { + output file /var/log/caddy/dashboard.log + } +} + +64815139.xyz { + redir https://www.{host}{uri} +} + +gitea.64815139.xyz { + rewrite /user/login /user/oauth2/Authelia + reverse_proxy 192.168.0.221:3000 +} + +immich.64815139.xyz { + reverse_proxy 192.168.0.221:2283 +} \ No newline at end of file diff --git a/gateway/cloudflare-ddns/config.json b/gateway/cloudflare-ddns/config.json new file mode 100644 index 0000000..8eedfbf --- /dev/null +++ b/gateway/cloudflare-ddns/config.json @@ -0,0 +1,36 @@ +{ + "cloudflare": [ + { + "authentication": { + "api_token": "${CF_DDNS_API_TOKEN}" + }, + "zone_id": "65b9e7fd2d53286d6af49e9b79357729", + "subdomains": [ + { + "name": "", + "proxied": false + }, + { + "name": "www", + "proxied": false + }, + { + "name": "auth", + "proxied": false + }, + { + "name": "gitea", + "proxied": false + }, + { + "name": "immich", + "proxied": false + } + ] + } + ], + "a": true, + "aaaa": false, + "purgeUnknownRecords": false, + "ttl": 300 +} \ No newline at end of file diff --git a/gateway/dashboard/icons/gitea.svg b/gateway/dashboard/icons/gitea.svg new file mode 100644 index 0000000..9df6b83 --- /dev/null +++ b/gateway/dashboard/icons/gitea.svg @@ -0,0 +1,31 @@ + + + + + + + + + + + + diff --git a/gateway/dashboard/icons/immich.svg b/gateway/dashboard/icons/immich.svg new file mode 100644 index 0000000..08e60a4 --- /dev/null +++ b/gateway/dashboard/icons/immich.svg @@ -0,0 +1,29 @@ + + + + + + + + + + + + diff --git a/gateway/dashboard/index.html b/gateway/dashboard/index.html new file mode 100644 index 0000000..ddc1316 --- /dev/null +++ b/gateway/dashboard/index.html @@ -0,0 +1,35 @@ + + + + + + + Applications + + + + +
+ +
+ + + \ No newline at end of file diff --git a/gateway/dashboard/styles.css b/gateway/dashboard/styles.css new file mode 100644 index 0000000..bf96b27 --- /dev/null +++ b/gateway/dashboard/styles.css @@ -0,0 +1,103 @@ +/* Basic reset */ +* { + margin: 0; + padding: 0; + box-sizing: border-box; +} + +body { + font-family: Arial, sans-serif; + background-color: #f0f0f0; + display: flex; + align-items: center; + justify-content: center; + height: 100vh; +} + +.container { + width: 90%; + max-width: 1200px; + margin: 0 auto; +} + +.app-grid { + list-style: none; + display: flex; + flex-wrap: wrap; + gap: 20px; + justify-content: center; +} + +.app-item { + background: #fff; + border: 1px solid #ddd; + overflow: hidden; + width: 150px; + height: 150px; + /* Ensuring the item is square */ + text-align: center; + transition: transform 0.2s, box-shadow 0.2s; +} + +.app-item a { + text-decoration: none; + color: #333; + display: block; + height: 100%; + display: flex; + flex-direction: column; + align-items: center; + justify-content: center; + padding: 16px; +} + +.app-icon-wrapper { + width: 100%; + height: 70%; + display: flex; + align-items: center; + justify-content: center; +} + +.app-icon { + max-height: 100%; + max-width: 100%; +} + +.app-name { + margin-top: 10px; + font-size: 16px; + font-weight: bold; + height: 20%; + display: flex; + align-items: center; + justify-content: center; + text-align: center; +} + +.app-item:hover { + transform: scale(1.05); + box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1); +} + +.app-item:active { + transform: scale(0.95); + box-shadow: 0 2px 4px rgba(0, 0, 0, 0.2); +} + +/* Responsive design */ +@media (max-width: 768px) { + .app-item { + width: 120px; + height: 120px; + /* Ensuring the item is square */ + } +} + +@media (max-width: 480px) { + .app-item { + width: 100px; + height: 100px; + /* Ensuring the item is square */ + } +} \ No newline at end of file diff --git a/gateway/docker-compose.yml b/gateway/docker-compose.yml new file mode 100644 index 0000000..e028db8 --- /dev/null +++ b/gateway/docker-compose.yml @@ -0,0 +1,116 @@ +name: gateway +secrets: + JWT_SECRET: + file: './authelia/secrets/auth/JWT_SECRET' + SESSION_SECRET: + file: './authelia/secrets/auth/SESSION_SECRET' + STORAGE_ENCRYPTION_KEY: + file: './authelia/secrets/auth/STORAGE_ENCRYPTION_KEY' + SMTP_USERNAME: + file: './authelia/secrets/auth/SMTP_USERNAME' + SMTP_PASSWORD: + file: './authelia/secrets/auth/SMTP_PASSWORD' + HMAC_SECRET: + file: './authelia/secrets/auth/HMAC_SECRET' + POSTGRES_PASSWORD: + file: './authelia/secrets/postgres/POSTGRES_PASSWORD' + REDIS_PASSWORD: + file: './authelia/secrets/redis/REDIS_PASSWORD' + OIDC_JWKS_AUTHELIA_PEM: + file: './authelia/secrets/jwks/rs256.pem' + OIDC_JWKS_AUTHELIA_CERT: + file: './authelia/secrets/jwks/rs256.cert' + IMMICH_CLIENT_SECRET: + file: './authelia/secrets/clients/IMMICH_CLIENT_SECRET' + GITEA_CLIENT_SECRET: + file: './authelia/secrets/clients/GITEA_CLIENT_SECRET' +services: + authelia: + image: 'docker.io/authelia/authelia:latest' + container_name: gateway_authelia + restart: 'unless-stopped' + expose: + - 9091 + depends_on: + - postgres + - redis + secrets: + - JWT_SECRET + - SESSION_SECRET + - STORAGE_ENCRYPTION_KEY + - SMTP_USERNAME + - SMTP_PASSWORD + - POSTGRES_PASSWORD + - REDIS_PASSWORD + - HMAC_SECRET + - OIDC_JWKS_AUTHELIA_PEM + - OIDC_JWKS_AUTHELIA_CERT + - IMMICH_CLIENT_SECRET + - GITEA_CLIENT_SECRET + environment: + AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/JWT_SECRET + AUTHELIA_SESSION_SECRET_FILE: /run/secrets/SESSION_SECRET + AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/STORAGE_ENCRYPTION_KEY + AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD + AUTHELIA_SESSION_REDIS_PASSWORD_FILE: /run/secrets/REDIS_PASSWORD + AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: /run/secrets/HMAC_SECRET + AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: /run/secrets/SMTP_PASSWORD + X_AUTHELIA_CONFIG_FILTERS: template + volumes: + - ./authelia/config:/config + postgres: + image: postgres:17 + container_name: gateway_postgres + restart: unless-stopped + secrets: + - POSTGRES_PASSWORD + environment: + POSTGRES_USER: "authelia" + POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD + volumes: + - ./data/postgres:/var/lib/postgresql/data + redis: + image: redis:7 + container_name: gateway_redis + restart: unless-stopped + env_file: + - ./secrets/redis/.env + entrypoint: /bin/sh -c + command: "redis-server --save 60 1 --loglevel warning --requirepass $$REDIS_PASSWORD" + volumes: + - ./data/redis:/data + caddy: + image: caddy:2.8.4-alpine + container_name: gateway_caddy + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "443:443/udp" + volumes: + - ./caddy/Caddyfile:/etc/caddy/Caddyfile + - ./dashboard:/var/www/dashboard + - caddy_data:/data + - caddy_config:/config + ddns: + image: timothyjmiller/cloudflare-ddns:latest + container_name: gateway_cloudflare_ddns + security_opt: + - no-new-privileges:true + network_mode: 'host' + env_file: + - ./cloudflare-ddns/secrets/.env + environment: + PUID: 1000 + PGID: 1000 + volumes: + - ./cloudflare-ddns/config.json:/config.json + restart: unless-stopped + watchtower: + image: containrrr/watchtower + container_name: gateway_watchtower + volumes: + - /var/run/docker.sock:/var/run/docker.sock +volumes: + caddy_data: + caddy_config: \ No newline at end of file diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml new file mode 100644 index 0000000..af0fa15 --- /dev/null +++ b/gitea/docker-compose.yml @@ -0,0 +1,54 @@ +name: gitea +secrets: + SMTP_USERNAME: + file: './secrets/mail/SMTP_USERNAME' + SMTP_PASSWORD: + file: './secrets/mail/SMTP_PASSWORD' +services: + server: + image: gitea/gitea:1.22.2 + container_name: gitea_app + restart: always + secrets: + - SMTP_USERNAME + - SMTP_PASSWORD + environment: + USER_UID: 1000 + USER_GID: 1000 + GITEA__server__ROOT_URL: https://gitea.64815139.xyz + GITEA__service__DISABLE_REGISTRATION: false + GITEA__service__ENABLE_BASIC_AUTHENTICATION: false + GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: true + GITEA__service__SHOW_REGISTRATION_BUTTON: false + GITEA__service__ENABLE_NOTIFY_MAIL: true + GITEA__mailer__ENABLED: true + GITEA__mailer__FROM: 'Gitea ' + GITEA__mailer__PROTOCOL: smtp+starttls + GITEA__mailer__SMTP_ADDR: in-v3.mailjet.com + GITEA__mailer__SMTP_PORT: 587 + GITEA__mailer__USER__FILE: /run/secrets/SMTP_USERNAME + GITEA__mailer__PASSWD__FILE: /run/secrets/SMTP_PASSWORD + GITEA__openid__ENABLE_OPENID_SIGNIN: true + GITEA__openid__ENABLE_OPENID_SIGNUP: true + GITEA__openid__WHITELISTED_URLS: auth.64815139.xyz + GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION: true + GITEA__oauth2_client__ACCOUNT_LINKING: auto + GITEA__oauth2_client__USERNAME: nickname + GITEA__oauth2_client__OPENID_CONNECT_SCOPES: openid profile email + networks: + - default + volumes: + - ./data:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + ports: + - "3000:3000" + - "222:22" + watchtower: + image: containrrr/watchtower + container_name: gitea_watchtower + volumes: + - /var/run/docker.sock:/var/run/docker.sock +networks: + default: + external: false \ No newline at end of file diff --git a/immich/.env b/immich/.env new file mode 100644 index 0000000..099b004 --- /dev/null +++ b/immich/.env @@ -0,0 +1,17 @@ +# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables + +# The location where your uploaded files are stored +UPLOAD_LOCATION=./data/library +# The location where your database files are stored +DB_DATA_LOCATION=./data/postgres + +# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List +# TZ=Etc/UTC + +# The Immich version to use. You can pin this to a specific version like "v1.71.0" +IMMICH_VERSION=release + +# The values below this line do not need to be changed +################################################################################### +DB_USERNAME=postgres +DB_DATABASE_NAME=immich diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml new file mode 100644 index 0000000..7d77698 --- /dev/null +++ b/immich/docker-compose.yml @@ -0,0 +1,85 @@ +# +# WARNING: Make sure to use the docker-compose.yml of the current release: +# +# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml +# +# The compose file on main may not be compatible with the latest release. +# + +name: immich + +secrets: + POSTGRES_PASSWORD: + file: './secrets/postgres/POSTGRES_PASSWORD' +services: + immich-server: + container_name: immich_server + image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} + # extends: + # file: hwaccel.transcoding.yml + # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding + volumes: + # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file + - ${UPLOAD_LOCATION}:/usr/src/app/upload + - /etc/localtime:/etc/localtime:ro + secrets: + - POSTGRES_PASSWORD + environment: + DB_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD + env_file: + - .env + ports: + - 2283:3001 + depends_on: + - redis + - database + restart: always + healthcheck: + disable: false + + immich-machine-learning: + container_name: immich_machine_learning + # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag. + # Example tag: ${IMMICH_VERSION:-release}-cuda + image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} + # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration + # file: hwaccel.ml.yml + # service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable + volumes: + - model-cache:/cache + env_file: + - .env + restart: always + healthcheck: + disable: false + + redis: + container_name: immich_redis + image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792 + healthcheck: + test: redis-cli ping || exit 1 + restart: always + + database: + container_name: immich_postgres + image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 + secrets: + - POSTGRES_PASSWORD + environment: + POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD + POSTGRES_USER: ${DB_USERNAME} + POSTGRES_DB: ${DB_DATABASE_NAME} + POSTGRES_INITDB_ARGS: '--data-checksums' + volumes: + # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file + - ${DB_DATA_LOCATION}:/var/lib/postgresql/data + healthcheck: + test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1 + interval: 5m + start_interval: 30s + start_period: 5m + command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"] + restart: always + +volumes: + model-cache: diff --git a/immich/hwaccel.ml.yml b/immich/hwaccel.ml.yml new file mode 100644 index 0000000..d9455d2 --- /dev/null +++ b/immich/hwaccel.ml.yml @@ -0,0 +1,43 @@ +# Configurations for hardware-accelerated machine learning + +# If using Unraid or another platform that doesn't allow multiple Compose files, +# you can inline the config for a backend by copying its contents +# into the immich-machine-learning service in the docker-compose.yml file. + +# See https://immich.app/docs/features/ml-hardware-acceleration for info on usage. + +services: + armnn: + devices: + - /dev/mali0:/dev/mali0 + volumes: + - /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver) + - /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required) + + cpu: {} + + cuda: + deploy: + resources: + reservations: + devices: + - driver: nvidia + count: 1 + capabilities: + - gpu + + openvino: + device_cgroup_rules: + - 'c 189:* rmw' + devices: + - /dev/dri:/dev/dri + volumes: + - /dev/bus/usb:/dev/bus/usb + + openvino-wsl: + devices: + - /dev/dri:/dev/dri + - /dev/dxg:/dev/dxg + volumes: + - /dev/bus/usb:/dev/bus/usb + - /usr/lib/wsl:/usr/lib/wsl diff --git a/immich/hwaccel.transcoding.yml b/immich/hwaccel.transcoding.yml new file mode 100644 index 0000000..bd4e2a4 --- /dev/null +++ b/immich/hwaccel.transcoding.yml @@ -0,0 +1,55 @@ +# Configurations for hardware-accelerated transcoding + +# If using Unraid or another platform that doesn't allow multiple Compose files, +# you can inline the config for a backend by copying its contents +# into the immich-microservices service in the docker-compose.yml file. + +# See https://immich.app/docs/features/hardware-transcoding for more info on using hardware transcoding. + +services: + cpu: {} + + nvenc: + deploy: + resources: + reservations: + devices: + - driver: nvidia + count: 1 + capabilities: + - gpu + - compute + - video + + quicksync: + devices: + - /dev/dri:/dev/dri + + rkmpp: + security_opt: # enables full access to /sys and /proc, still far better than privileged: true + - systempaths=unconfined + - apparmor=unconfined + group_add: + - video + devices: + - /dev/rga:/dev/rga + - /dev/dri:/dev/dri + - /dev/dma_heap:/dev/dma_heap + - /dev/mpp_service:/dev/mpp_service + #- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + volumes: + #- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + #- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping + + vaapi: + devices: + - /dev/dri:/dev/dri + + vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2 + devices: + - /dev/dri:/dev/dri + volumes: + - /usr/lib/wsl:/usr/lib/wsl + environment: + - LD_LIBRARY_PATH=/usr/lib/wsl/lib + - LIBVA_DRIVER_NAME=d3d12