un container

modules/nixos/services/jellyseerr/default.nix

@@ -6,78 +6,46 @@
 }:
 with lib;
 let
+  inherit (lib.${namespace}) mkOpt mkReverseProxyOpt;
   cfg = config.${namespace}.services.jellyseerr;
 
   jellyseerrPort = 5055;
-  dataDir = "/var/lib/private/jellyseerr";
 in
 {
-  imports = [ ./options.nix ];
+  options.${namespace}.services.jellyseerr = {
+    enable = mkEnableOption "enable jellyseerr";
+
+    port = mkOpt types.int 5055 "jellyseerr port";
+
+    dataDir = mkOpt types.str "" "data dir";
+  };
 
   config = mkIf cfg.enable {
-    containers.jellyseerr = {
-      autoStart = true;
-      privateNetwork = true;
-      hostAddress = "10.0.1.3";
-      localAddress = "10.0.1.52";
-      hostAddress6 = "fc00::1";
-      localAddress6 = "fc00::4";
+    # Enable jellyseerr service
+    services.jellyseerr = {
+      enable = true;
+      port = cfg.port;
+      openFirewall = true;
+      configDir = cfg.dataDir;
+    };
 
-      bindMounts = {
-        ${dataDir} = {
-          hostPath = "/media/nas/main/nix-app-data/jellyseerr";
-          isReadOnly = false;
+    systemd.services = {
+      jellyseerr = {
+        serviceConfig = {
+          WorkingDirectory = lib.mkForce cfg.dataDir;
+          StateDirectory = lib.mkForce cfg.dataDir;
+          StateDirectoryMode = lib.mkForce 700;
+          DynamicUser = lib.mkForce false;
+          ProtectSystem = lib.mkForce null;
         };
       };
-
-      config =
-        {
-          lib,
-          ...
-        }:
-        {
-          # Enable jellyseerr service
-          services.jellyseerr = {
-            enable = true;
-            port = jellyseerrPort;
-            # package = package;
-            openFirewall = true;
-          };
-
-          networking = {
-            firewall = {
-              enable = true;
-              allowedTCPPorts = [ jellyseerrPort ];
-            };
-            # Use systemd-resolved inside the container
-            # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-            useHostResolvConf = lib.mkForce false;
-          };
-
-          # Create and set permissions for required directories
-          system.activationScripts.jellyseerr-dirs = ''
-            mkdir -p /var/lib/private/jellyseerr
-
-            chown -R jellyseerr:jellyseerr /var/lib/private/jellyseerr
-
-            chmod -R 775 /var/lib/private/jellyseerr
-
-            ln -sf /var/lib/private/jellyseerr /var/lib/jellyfin
-
-          '';
-
-          services.resolved.enable = true;
-          system.stateVersion = "23.11";
-        };
     };
 
-    networking.nat = {
-      forwardPorts = [
-        {
-          destination = "10.0.1.52:5055";
-          sourcePort = jellyseerrPort;
-        }
-      ];
+    users.users.jellyseerr = {
+      isSystemUser = true;
+      group = "jellyseerr";
+      home = cfg.dataDir;
     };
+    users.groups.jellyseerr = {};
   };
 }

modules/nixos/services/jellyseerr/default.nix.container

@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+with lib;
+let
+  cfg = config.${namespace}.services.jellyseerr;
+
+  jellyseerrPort = 5055;
+  dataDir = "/var/lib/private/jellyseerr";
+in
+{
+  imports = [ ./options.nix ];
+
+  config = mkIf cfg.enable {
+    containers.jellyseerr = {
+      autoStart = true;
+      privateNetwork = true;
+      hostAddress = "10.0.1.3";
+      localAddress = "10.0.1.52";
+      hostAddress6 = "fc00::1";
+      localAddress6 = "fc00::4";
+
+      bindMounts = {
+        ${dataDir} = {
+          hostPath = "/media/nas/main/nix-app-data/jellyseerr";
+          isReadOnly = false;
+        };
+      };
+
+      config =
+        {
+          lib,
+          ...
+        }:
+        {
+          # Enable jellyseerr service
+          services.jellyseerr = {
+            enable = true;
+            port = jellyseerrPort;
+            # package = package;
+            openFirewall = true;
+          };
+
+          networking = {
+            firewall = {
+              enable = true;
+              allowedTCPPorts = [ jellyseerrPort ];
+            };
+            # Use systemd-resolved inside the container
+            # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+            useHostResolvConf = lib.mkForce false;
+          };
+
+          # Create and set permissions for required directories
+          system.activationScripts.jellyseerr-dirs = ''
+            mkdir -p /var/lib/private/jellyseerr
+
+            chown -R jellyseerr:jellyseerr /var/lib/private/jellyseerr
+
+            chmod -R 775 /var/lib/private/jellyseerr
+
+            ln -sf /var/lib/private/jellyseerr /var/lib/jellyfin
+
+          '';
+
+          services.resolved.enable = true;
+          system.stateVersion = "23.11";
+        };
+    };
+
+    networking.nat = {
+      forwardPorts = [
+        {
+          destination = "10.0.1.52:5055";
+          sourcePort = jellyseerrPort;
+        }
+      ];
+    };
+  };
+}