Add immich vm, changes

2 files changed, 39 insertions, 0 deletions

diff --git a/templates/etc_rc.conf.j2 b/templates/etc_rc.conf.j2
index 03b5d10..5df2d7c 100644
--- a/templates/etc_rc.conf.j2
+++ b/templates/etc_rc.conf.j2
@@ -31,3 +31,5 @@ clear_tmp_enable="YES"
 cleanvar_enable="YES"
 auditd_enable="YES"
 devd_enable="YES"
+vm_enable="YES"
+vm_dir="zfs:zroot/vm"
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index c568a7f..e6e35b2 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -109,6 +109,43 @@ http {
             index index.html;
         }
     }
+    {% elif route.ip is defined -%}
+    server {
+        server_name {{ route.host }};
+        http2 on;
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
+        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
+
+        location / {
+            proxy_pass http://{{ route.ip }}:{{ route.port }};
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # TODO: these shouldn't configured for all ip:port proxies but Immich needs them
+            proxy_http_version 1.1;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            # by default nginx times out connections in one minute
+            proxy_read_timeout 1d;
+            proxy_send_timeout 1d;
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 10G;
+        }
+    }
     {% endif %}
     {% endfor %}
 }