updates and nixifying

hosts/nas/apps/arrs/default.nix

@@ -0,0 +1,172 @@
+{ config, pkgs, lib, ... }:
+
+let
+  radarrPort = 7878;
+  sonarrPort = 8989;
+  sabnzbdPort = 8080;
+  radarrDataDir = "/var/lib/radarr";
+  downloadDir = "/downloads";
+  incompleteDir = "/downloads-incomplete";
+  sonarrDataDir = "/var/lib/sonarr";
+  sabnzbdConfig = "/var/lib/sabnzbd";
+  mediaDir = "/media";
+  arrUserId = config.users.users.nix-apps.uid;
+  arrGroupId = config.users.groups.jallen-nas.gid;
+  sonarrPkg = pkgs.unstable.sonarr;
+in
+{
+
+  containers.arrs = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.0.1.18";
+    localAddress = "10.0.1.51";
+    
+    config = { config, pkgs, lib, ... }: {
+      nixpkgs.config.permittedInsecurePackages = [
+        "aspnetcore-runtime-6.0.36"
+        "aspnetcore-runtime-wrapped-6.0.36"
+        "dotnet-sdk-6.0.428"
+        "dotnet-sdk-wrapped-6.0.428"
+      ];
+
+      nixpkgs.config.allowUnfree = true;
+      
+      # Enable radarr service
+      services.radarr = {
+        enable = true;
+        openFirewall = true;
+        user = "arrs";
+        group = "media";
+        dataDir = radarrDataDir;
+      };
+
+      # Enable Sonarr service
+      services.sonarr = {
+        enable = true;
+        openFirewall = true;
+        user = "arrs";
+        group = "media";
+        dataDir = sonarrDataDir;
+        package = sonarrPkg;
+      };
+
+      # Enable Sabnzbd service
+      services.sabnzbd = {
+        enable = true;
+        openFirewall = true;
+        user = "arrs";
+        group = "media";
+        configFile = "${sabnzbdConfig}/sabnzbd.ini";
+      };
+
+      # Create required users and groups
+      users.users.arrs = {
+        isSystemUser = true;
+        uid = lib.mkForce arrUserId;
+        group = "media";
+        extraGroups = [ "downloads" ];
+      };
+
+      users.groups = {
+        media = { gid = lib.mkForce arrGroupId; };
+        downloads = {};
+      };
+
+      # System packages
+      environment.systemPackages = with pkgs; [
+        sqlite
+        mono
+        mediainfo
+        protonvpn-cli
+      ];
+
+      # Create and set permissions for required directories
+      system.activationScripts.radarr-dirs = ''
+        mkdir -p ${radarrDataDir}
+        mkdir -p ${sonarrDataDir}
+        mkdir -p ${sabnzbdConfig}
+        mkdir -p ${downloadDir}
+        mkdir -p ${incompleteDir}
+        mkdir -p ${mediaDir}
+
+        chown -R arrs:media ${radarrDataDir}
+        chown -R arrs:media ${sonarrDataDir}
+        chown -R arrs:media ${sabnzbdConfig}
+        chown -R arrs:media ${downloadDir}
+        chown -R arrs:media ${incompleteDir}
+        chown -R arrs:media ${mediaDir}
+        
+        chmod -R 775 ${radarrDataDir}
+        chmod -R 775 ${sonarrDataDir}
+        chmod -R 775 ${sabnzbdConfig}
+        chmod -R 775 ${downloadDir}
+        chmod -R 775 ${incompleteDir}
+        chmod -R 775 ${mediaDir}
+        
+      '';
+
+        networking = {
+          firewall = {
+            enable = true;
+            allowedTCPPorts = [ radarrPort sonarrPort sabnzbdPort ];
+          };
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+
+        services.resolved.enable = true;
+        system.stateVersion = "23.11";
+      };
+
+    # Bind mount directories from host
+    bindMounts = {
+      "${radarrDataDir}" = {
+        hostPath = "/media/nas/ssd/nix-app-data/radarr";
+        isReadOnly = false;
+      };
+      "${sonarrDataDir}" = {
+        hostPath = "/media/nas/ssd/nix-app-data/sonarr";
+        isReadOnly = false;
+      };
+      "${sabnzbdConfig}" = {
+        hostPath = "/media/nas/ssd/nix-app-data/sabnzbd";
+        isReadOnly = false;
+      };
+      "${downloadDir}" = {
+        hostPath = "/media/nas/ssd/ssd_app_data/downloads";
+        isReadOnly = false;
+      };
+      "${incompleteDir}" = {
+        hostPath = "/media/nas/ssd/ssd_app_data/downloads-incomplete";
+        isReadOnly = false;
+      };
+      "/media/movies" = {
+        hostPath = "/media/nas/main/movies";
+        isReadOnly = false;
+      };
+      "/media/tv" = {
+        hostPath = "/media/nas/main/tv";
+        isReadOnly = false;
+      };
+    };
+  };
+
+  networking.nat = {
+    forwardPorts = [
+      {
+        destination = "10.0.1.51:7878";
+        sourcePort = radarrPort;
+      }
+      {
+        destination = "10.0.1.51:8989";
+        sourcePort = sonarrPort;
+      }
+      {
+        destination = "10.0.1.51:8080";
+        sourcePort = sabnzbdPort;
+      }
+    ];
+  };
+}