• 0 Posts
  • 107 Comments
Joined 2 years ago
Cake day: June 30th, 2023
  • InnerScientist@lemmy.worldtoSelfhosted@lemmy.world•MicroOS: Rootless podman?English
    2·
    2 months ago

    Tldr:

    Rootful podman with podman run --userns=auto is more secure than one rootless host user running many pods, because those pods could (theoretically) attack each other.
    though you still have the possibility of an exploit in the image pull

    Rootless podman running one pod (as in service including database and so on) per host user with different subuid Ranges is the most secure, but you have to actually set that up which can be a lot of work depending on distribution.

  • InnerScientist@lemmy.worldtoLinux@lemmy.ml•Immich 1.132 Brings Smoother Syncing, Mobile UI Enhancements
    4·
    2 months ago

    Sure, I set it up in nixos though this is the short form of that:

    spoiler
    1. Install Podman and passt + slirp4netns for networking
    2. Setup subuid and subgid usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe
    3. I’m using quadlet’s so we need to create those: $HOME/.config/containers/systemd/immich-database.container
    [Unit]
Description=Immich Database
Requires=immich-redis.service immich-network.service

[Container]
AutoUpdate=registry
EnvironmentFile=${immich-config} # add your environment variables file here
Image=registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 # hash from the official docker-compose, has to be updated from time to time
Label=registry
Pull=newer # update to newest image, though this image is specified by hash and will never update to another version unless the hash is changed
Network=immich.network # attach to the podman network
UserNS=keep-id:uid=999,gid=999 # This makes uid 999 and gid 999 map to the user running the service, this is so that you can access the files in the volume without any special handling otherwise root would map to your uid and the uid 999 would map to some very high uid that you can't access without podman - This modifies the image at runtime and may make the systemd service timeout, maybe increase the timeout on low-powered machines 
Volume=/srv/services/immich/database:/var/lib/postgresql/data # Database persistance
Volume=/etc/localtime:/etc/localtime:ro # timezone info
Exec=postgres -c shared_preload_libraries=vectors.so -c 'search_path="$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on # also part of official docker-compose.....last time i checked anyways
[Service]
Restart=always

    $HOME/.config/containers/systemd/immich-ml.container

    [Unit]
Description=Immich Machine Learning
Requires=immich-redis.service immich-database.service immich-network.service

[Container]
AutoUpdate=registry
EnvironmentFile=${immich-config} #same config as above
Image=ghcr.io/immich-app/immich-machine-learning:release
Label=registry
Pull=newer # auto update on startup
Network=immich.network
Volume=/srv/services/immich/ml-cache:/cache # machine learning cache
Volume=/etc/localtime:/etc/localtime:ro

[Service]
Restart=always

    $HOME/.config/containers/systemd/immich.network

    [Unit]
Description=Immich network

[Network]
DNS=8.8.8.8
Label=app=immich

$HOME/.config/containers/systemd/immich-redis.container
[Unit]
Description=Immich Redis
Requires=immich-network.service

[Container]
AutoUpdate=registry
Image=registry.hub.docker.com/library/redis:6.2-alpine@sha256:eaba718fecd1196d88533de7ba49bf903ad33664a92debb24660a922ecd9cac8 # should probably change this  to valkey.... 
Label=registry
Pull=newer # auto update on startup
Network=immich.network
Timezone=Europe/Berlin

[Service]
Restart=always

    $HOME/.config/containers/systemd/immich-server.container

    [Unit]
Description=Immich Server
Requires=immich-redis.service immich-database.service immich-network.service immich-ml.service

[Container]
AutoUpdate=registry
EnvironmentFile=${immich-config} #same config as above
Image=ghcr.io/immich-app/immich-server:release
Label=registry
Pull=newer # auto update on startup
Network=immich.network
PublishPort=127.0.0.1:2283:2283
Volume=/srv/services/immich/upload:/usr/src/app/upload # i think you can put images here to import, though i never used it
Volume=/etc/localtime:/etc/localtime:ro # timezone info
Volume=/srv/services/immich/library:/imageLibrary # here the images are stored once imported

[Service]
Restart=always

[Install]
WantedBy=multi-user.target default.target
    1. systemctl --user daemon-reload
    2. systemctl --user enable --now immich-server.service
    3. enable linger so systemd user services run even if the user is logged of loginctl enable-linger $USER
    4. Setup a reverse proxy like caddy so you can make access to it simple like immich.mini-pc.localnet