How to Build
Your Own Photo Server

{ config, pkgs, ... }:

{
  imports = [ ./hardware-configuration.nix ];

  # ── Boot ────────────────────────────────────────────────────
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # ── Network ─────────────────────────────────────────────────
  networking.hostName = "photo-server"; # Change to your liking
  networking.networkmanager.enable = true;

  # ── Locale ──────────────────────────────────────────────────
  time.timeZone = "Europe/London"; # Change to your timezone
  i18n.defaultLocale = "en_GB.UTF-8";

  # ── User account ────────────────────────────────────────────
  users.users.alice = {  # Change 'alice' to your username
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAA... paste-your-public-key-here"
    ];
  };
  security.sudo.wheelNeedsPassword = false;

  # ── SSH ─────────────────────────────────────────────────────
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false; # Key-only login
  };

  # ── Photo storage drive ─────────────────────────────────────
  # Format your photos drive with: mkfs.ext4 -L photos /dev/sdXY
  fileSystems."/data/photos" = {
    device = "/dev/disk/by-label/photos";
    fsType = "ext4";
  };

  # ── Immich ──────────────────────────────────────────────────
  # NixOS manages PostgreSQL and Redis automatically for Immich
  services.immich = {
    enable = true;
    host = "127.0.0.1";    # Local only — tunnel handles external
    port = 2283;
    mediaLocation = "/data/photos";
    openFirewall = false; # Cloudflare tunnel handles ingress
  };

  # ── Cloudflare tunnel ───────────────────────────────────────
  services.cloudflared = {
    enable = true;
    tunnels = {
      "immich" = {
        # Path to the JSON you downloaded from the Cloudflare dashboard
        credentialsFile = "/etc/cloudflared/immich.json";
        default = "http_status:404";
        ingress = {
          # Change to your actual domain
          "photos.yourdomain.com" = "http://127.0.0.1:2283";
        };
      };
    };
  };

  # ── Firewall ────────────────────────────────────────────────
  # Only SSH — Cloudflare tunnel needs no open inbound ports
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 22 ];
  };

  system.stateVersion = "24.11";
}