nixos config for immich + restic backups
I am running my own instance of the fantastic immich.
A recurrent topic is how to backup the data ? The official website has a
guide some
recommendations easy to translate into nix code (use
services.postgresqlBackup).
I wanted to create a setup such that the backup program would not be able to mess up and delete the pictures, e.g. the backup program (restic) should have read-only access and not file ownership so it can't change the permissions.
One change I had to do is to override the nixos service UMask to let immich give read-access to the unix group:
systemd.services.immich-server.serviceConfig = {
# we override the default 0077 such that the backup job can read the files
UMask = "0027";
};
And then move the restic job to run as the immich group:
systemd.services.restic-backups-immich-db-to-backblaze.serviceConfig = {
Group = "immich"; # such that it can read the files
};
To be able to save already uploaded files, you need to update their permissions as well which can be done via:
sudo chmod -R g+r /var/lib/immich/upload/
You can check group permissions with for instance:
find /var/lib/immich/upload -type f -perm /g=r