• 0 Posts
  • 36 Comments
Joined 2 years ago
cake
Cake day: June 30th, 2023

help-circle

  • Sure, I set it up in nixos though this is the short form of that:

    spoiler
    1. Install Podman and passt + slirp4netns for networking
    2. Setup subuid and subgid usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe
    3. I’m using quadlet’s so we need to create those: $HOME/.config/containers/systemd/immich-database.container
    [Unit]
    Description=Immich Database
    Requires=immich-redis.service immich-network.service
    
    [Container]
    AutoUpdate=registry
    EnvironmentFile=${immich-config} # add your environment variables file here
    Image=registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 # hash from the official docker-compose, has to be updated from time to time
    Label=registry
    Pull=newer # update to newest image, though this image is specified by hash and will never update to another version unless the hash is changed
    Network=immich.network # attach to the podman network
    UserNS=keep-id:uid=999,gid=999 # This makes uid 999 and gid 999 map to the user running the service, this is so that you can access the files in the volume without any special handling otherwise root would map to your uid and the uid 999 would map to some very high uid that you can't access without podman - This modifies the image at runtime and may make the systemd service timeout, maybe increase the timeout on low-powered machines 
    Volume=/srv/services/immich/database:/var/lib/postgresql/data # Database persistance
    Volume=/etc/localtime:/etc/localtime:ro # timezone info
    Exec=postgres -c shared_preload_libraries=vectors.so -c 'search_path="$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on # also part of official docker-compose.....last time i checked anyways
    [Service]
    Restart=always
    

    $HOME/.config/containers/systemd/immich-ml.container

    [Unit]
    Description=Immich Machine Learning
    Requires=immich-redis.service immich-database.service immich-network.service
    
    [Container]
    AutoUpdate=registry
    EnvironmentFile=${immich-config} #same config as above
    Image=ghcr.io/immich-app/immich-machine-learning:release
    Label=registry
    Pull=newer # auto update on startup
    Network=immich.network
    Volume=/srv/services/immich/ml-cache:/cache # machine learning cache
    Volume=/etc/localtime:/etc/localtime:ro
    
    [Service]
    Restart=always
    

    $HOME/.config/containers/systemd/immich.network

    [Unit]
    Description=Immich network
    
    [Network]
    DNS=8.8.8.8
    Label=app=immich
    
    $HOME/.config/containers/systemd/immich-redis.container
    [Unit]
    Description=Immich Redis
    Requires=immich-network.service
    
    [Container]
    AutoUpdate=registry
    Image=registry.hub.docker.com/library/redis:6.2-alpine@sha256:eaba718fecd1196d88533de7ba49bf903ad33664a92debb24660a922ecd9cac8 # should probably change this  to valkey.... 
    Label=registry
    Pull=newer # auto update on startup
    Network=immich.network
    Timezone=Europe/Berlin
    
    [Service]
    Restart=always
    

    $HOME/.config/containers/systemd/immich-server.container

    [Unit]
    Description=Immich Server
    Requires=immich-redis.service immich-database.service immich-network.service immich-ml.service
    
    [Container]
    AutoUpdate=registry
    EnvironmentFile=${immich-config} #same config as above
    Image=ghcr.io/immich-app/immich-server:release
    Label=registry
    Pull=newer # auto update on startup
    Network=immich.network
    PublishPort=127.0.0.1:2283:2283
    Volume=/srv/services/immich/upload:/usr/src/app/upload # i think you can put images here to import, though i never used it
    Volume=/etc/localtime:/etc/localtime:ro # timezone info
    Volume=/srv/services/immich/library:/imageLibrary # here the images are stored once imported
    
    [Service]
    Restart=always
    
    [Install]
    WantedBy=multi-user.target default.target
    
    1. systemctl --user daemon-reload
    2. systemctl --user enable --now immich-server.service
    3. enable linger so systemd user services run even if the user is logged of loginctl enable-linger $USER
    4. Setup a reverse proxy like caddy so you can make access to it simple like immich.mini-pc.localnet



  • The emails are unencrypted, emails in transit are in transit between the e-mail servers and relays and use secure tls channels.
    They are only encrypted from your phone/notebook/browser to the server, then when send they will be encrypted till the next server.

    Every server/relay first decrypts everything send to it, because it has to due to the TLS terminating at each server.

    See also your source:

    Transport Encryption: This form of encryption is used to secure your emails while they are transmitted over the internet. Most of today’s email services, including Gmail, employ transport layer security (TLS) to protect emails in transit. While it encrypts emails between servers, it doesn’t protect the content once it reaches the recipient’s inbox.1

    In practical terms, Your e-mail server, your e-mail servers relay (if it has any) and your recipients relay server/server can all read your email unless

    End-to-End Encryption (E2EE): E2EE takes encryption a step further. It ensures that only the sender and the recipient can decrypt and read the emails. Even the email service provider cannot access the contents of the email. E2EE is typically achieved through third-party encryption tools or services.1

    Which takes active effort from both the sender and the recipient to make work - it’s almost only possible with people you know and little else.

    1 https://umatechnology.org/gmails-new-encryption-can-make-email-safer-heres-why-you-should-use-it/










  • Instead of using systemd user services you can just use a normal systemd service and tell it to run the command as a specific user, put something like this in a file at /etc/systemd/system/<unit Name>.service

    [Unit]
    Description=Run service as user test
    After=network.target
    
    [Service]
    Type=simple
    User=test
    Group=test
    ExecStart=/opt/teamspoke
    
    [Install]
    WantedBy=default.target
    

    Then set it to start at boot

    systemctl enable <unit Name>.service
    

    And to start it now

    systemctl start <unit Name>.service