cumsek/nix
cumsek/nix
Watch
2
0
Fork
You've already forked nix
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(cum-media): run immich 3 from unstable #28

Merged
marti merged 1 commit from feature/immich-3 into main 2026-11-01 13:39:30 +01:00
Conversation 0 Commits 1 Files changed 1 +7 -1
marti commented 2026-11-01 13:39:12 +01:00
Owner

Summary

cum-media no longer evaluates: 26.05 only has immich 2.7.5, which is marked insecure and gets no more updates.

 services.immich = {
   enable = true;
+  package = pkgs-unstable.immich; # 2.7.5 -> 3.3.5
   inherit port;

The 26.05 module stays. Its differences from the unstable module don't affect this host.

Evidence

  • Before: nix eval .#nixosConfigurations.cum-media.config.system.build.toplevel.drvPath 
    error: Refusing to evaluate package 'immich-2.7.5' ... because it is marked as insecure
 - CVE-2026-59258
 - CVE-2026-82272
    After: 
    nixos-system-cum-media-26.05.20261031.fa13731.drv
{"immich":"3.3.5","ml":"3.3.5","postgres":"16.15"}

Evaluation only: this has not been built or run. A dry run of immich and its machine learning package shows nothing to compile locally.

Checked on cum-media against the immich 3.3.5 requirements:

Requirement On the host OK
Postgres >=14 16.15 yes
VectorChord >=0.3 <2 1.1.1 yes
pgvector >=0.5 <1 0.8.2 yes
x86-64-v2 CPU for machine learning sse4_2 present yes
Embeddings not on pgvecto.rs public.vector columns, vchordrq indexes yes

vectors 0.3.0 (pgvecto.rs) is still registered in the immich database, but it is an unused leftover. Its files are gone from disk, and a trial DROP EXTENSION and DROP SCHEMA succeeded and was rolled back.

Merge Danger

Door: one-way

The merge itself reverts cleanly, but deploying does not: immich migrates its database on first start, and switching NixOS generations won't undo that. Going back means the previous generation plus a database restore.

Before the first rebuild of cum-media from this:

sudo systemctl stop immich-server
sudo -u postgres pg_dump -Fc immich > ~/immich-pre-v3.dump
sudo -u postgres psql immich -c 'DROP EXTENSION vectors;' -c 'DROP SCHEMA vectors;'
sudo -u postgres psql immich -c 'REINDEX DATABASE immich;' -c 'ALTER DATABASE immich REFRESH COLLATION VERSION;'

The last line also clears an existing collation mismatch (glibc 2.40 to 2.42). It isn't caused by this upgrade.

Blast Radius: immich

Only the immich service on cum-media changes. Mobile apps should be updated, since the legacy timeline was removed. Scripts calling the immich API may need changes because endpoints were removed or changed, and dashboards need updating because metric names changed from underscores to dots.

🤖 Generated with Claude Code

## Summary `cum-media` no longer evaluates: 26.05 only has immich 2.7.5, which is marked insecure and gets no more updates. ```diff services.immich = { enable = true; + package = pkgs-unstable.immich; # 2.7.5 -> 3.3.5 inherit port; ``` The 26.05 module stays. Its differences from the unstable module don't affect this host. ## Evidence - **Before:** `nix eval .#nixosConfigurations.cum-media.config.system.build.toplevel.drvPath` ```text error: Refusing to evaluate package 'immich-2.7.5' ... because it is marked as insecure - CVE-2026-59258 - CVE-2026-82272 ``` **After:** ```text nixos-system-cum-media-26.05.20261031.fa13731.drv {"immich":"3.3.5","ml":"3.3.5","postgres":"16.15"} ``` Evaluation only: this has not been built or run. A dry run of immich and its machine learning package shows nothing to compile locally. Checked on `cum-media` against the immich 3.3.5 requirements: | Requirement | On the host | OK | |---|---|---| | Postgres `>=14` | 16.15 | yes | | VectorChord `>=0.3 <2` | 1.1.1 | yes | | pgvector `>=0.5 <1` | 0.8.2 | yes | | x86-64-v2 CPU for machine learning | `sse4_2` present | yes | | Embeddings not on pgvecto.rs | `public.vector` columns, `vchordrq` indexes | yes | `vectors` 0.3.0 (pgvecto.rs) is still registered in the `immich` database, but it is an unused leftover. Its files are gone from disk, and a trial `DROP EXTENSION` and `DROP SCHEMA` succeeded and was rolled back. ## Merge Danger **Door:** one-way The merge itself reverts cleanly, but deploying does not: immich migrates its database on first start, and switching NixOS generations won't undo that. Going back means the previous generation plus a database restore. Before the first rebuild of `cum-media` from this: ```sh sudo systemctl stop immich-server sudo -u postgres pg_dump -Fc immich > ~/immich-pre-v3.dump sudo -u postgres psql immich -c 'DROP EXTENSION vectors;' -c 'DROP SCHEMA vectors;' sudo -u postgres psql immich -c 'REINDEX DATABASE immich;' -c 'ALTER DATABASE immich REFRESH COLLATION VERSION;' ``` The last line also clears an existing collation mismatch (glibc 2.40 to 2.42). It isn't caused by this upgrade. **Blast Radius:** immich Only the immich service on `cum-media` changes. Mobile apps should be updated, since the legacy timeline was removed. Scripts calling the immich API may need changes because endpoints were removed or changed, and dashboards need updating because metric names changed from underscores to dots. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
26.05 only has immich 2.7.5, which gets no more updates and is marked
insecure (CVE-2026-59258, CVE-2026-82272), so the host stopped evaluating.
Permitting the insecure package would have left those CVEs unpatched.

The stable module stays: its differences from unstable's do not affect
this host, and the VectorChord and Postgres it sets up are in the range
immich 3 accepts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
marti merged commit ce23538f38 into main 2026-11-01 13:39:30 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
cumsek/nix!28
No description provided.