Commit `fdeba4891de4`

Vincent Demeester <vincent@sbr.pm>

2025-12-01 13:55:00

feat: Configure PostgreSQL declaratively for immich on rhea

Add declarative PostgreSQL configuration to ensure the vincent user has proper ownership and permissions for the immich database: - Create vincent PostgreSQL role via ensureUsers - Grant database ownership to vincent - Grant all privileges on public and vectors schemas - Set default privileges for future tables This ensures immich can connect via Unix sockets using the vincent user without authentication issues. The postStart script runs after PostgreSQL initialization to set up all necessary permissions. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vincent Demeester <vincent@sbr.pm>

main

1 parent 55da958

Changed files (1)

systems

rhea

extra.nix

@@ -336,6 +336,14 @@
       group = "users";
       mediaLocation = "/neo/pictures/photos";
     };
+    postgresql = {
+      ensureDatabases = [ "immich" ];
+      ensureUsers = [
+        {
+          name = "vincent";
+        }
+      ];
+    };
     jellyfin = {
       enable = true;
       user = "vincent";
@@ -461,6 +469,21 @@
     defaults.email = "vincent@sbr.pm";
   };
 
+  # Grant vincent ownership of the immich database and schemas
+  systemd.services.postgresql.postStart = lib.mkAfter ''
+    $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname = 'vincent'" | grep -q 1 || $PSQL -tAc "CREATE ROLE vincent WITH LOGIN"
+    $PSQL -tAc "ALTER DATABASE immich OWNER TO vincent"
+    $PSQL immich -tAc "ALTER SCHEMA public OWNER TO vincent"
+    $PSQL immich -tAc "ALTER SCHEMA vectors OWNER TO vincent" || true
+    $PSQL immich -tAc "GRANT ALL PRIVILEGES ON SCHEMA public TO vincent"
+    $PSQL immich -tAc "GRANT ALL PRIVILEGES ON SCHEMA vectors TO vincent" || true
+    $PSQL immich -tAc "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO vincent"
+    $PSQL immich -tAc "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO vincent"
+    $PSQL immich -tAc "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vectors TO vincent" || true
+    $PSQL immich -tAc "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO vincent"
+    $PSQL immich -tAc "ALTER DEFAULT PRIVILEGES IN SCHEMA vectors GRANT ALL ON TABLES TO vincent" || true
+  '';
+
   networking.useDHCP = lib.mkDefault true;
 
   # Open firewall for Traefik

Commit fdeba4891de4

Commit `fdeba4891de4`