use agenix

modules/services/immich.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }:
 let
   cfg = config.modules.services.immich;
+  secrets = config.age.secrets;
   fqdn = "${cfg.subdomain}.${config.networking.domain}";
 
   volumeServices = names: (
@@ -52,6 +53,13 @@ let
       { }
       services
   );
+
+  environment = {
+    TZ = cfg.timezone;
+    DB_USERNAME = "postgres";
+    POSTGRES_USER = environment.DB_USERNAME;
+    DB_DATABASE_NAME = "immich";
+  };
 in
 {
   options.modules.services.immich = {
@@ -59,6 +67,10 @@ in
     subdomain = lib.mkOption {
       type = lib.types.str;
     };
+    timezone = lib.mkOption {
+      type = lib.types.str;
+      default = "Europe/Helsinki";
+    };
     version = lib.mkOption {
       type = lib.types.str;
       default = "latest";
@@ -97,8 +109,9 @@ in
       virtualisation.oci-containers.containers = {
         "immich_machine_learning" = {
           image = "ghcr.io/immich-app/immich-machine-learning:${cfg.version}";
+          inherit environment;
           environmentFiles = [
-            "/var/secrets/immich.env"
+            secrets.immich.path
           ];
           volumes = [
             "immich_model_cache:/cache:rw"
@@ -113,9 +126,9 @@ in
         "immich_postgres" = {
           image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
           environmentFiles = [
-            "/var/secrets/immich.env"
+            secrets.immich.path
           ];
-          environment = {
+          environment = environment // {
             POSTGRES_INITDB_ARGS = "--data-checksums";
           };
           volumes = [
@@ -131,8 +144,9 @@ in
 
         "immich_redis" = {
           image = "registry.hub.docker.com/library/redis:6.2-alpine";
+          inherit environment;
           environmentFiles = [
-            "/var/secrets/immich.env"
+            secrets.immich.path
           ];
           log-driver = "journald";
           extraOptions = [
@@ -143,8 +157,9 @@ in
 
         "immich_server" = {
           image = "ghcr.io/immich-app/immich-server:${cfg.version}";
+          inherit environment;
           environmentFiles = [
-            "/var/secrets/immich.env"
+            secrets.immich.path
           ];
           volumes = [
             "/etc/localtime:/etc/localtime:ro"