mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updates and nixifying

Browse Source
This commit is contained in:
mjallen18
2024-12-18 16:08:17 -06:00
parent c259cb91de
commit c80092f588
26 changed files with 203 additions and 807 deletions
Download Patch File Download Diff File Expand all files Collapse all files

172
modules/apps/arrs/default.nix
View File

@@ -1,172 +0,0 @@
{ config, pkgs, lib, ... }:
let
radarrPort = 7878;
sonarrPort = 8989;
sabnzbdPort = 8080;
radarrDataDir = "/var/lib/radarr";
downloadDir = "/downloads";
incompleteDir = "/downloads-incomplete";
sonarrDataDir = "/var/lib/sonarr";
sabnzbdConfig = "/var/lib/sabnzbd";
mediaDir = "/media";
arrUserId = config.users.users.nix-apps.uid;
arrGroupId = config.users.groups.jallen-nas.gid;
sonarrPkg = pkgs.unstable.sonarr;
in
{
containers.arrs = {
autoStart = true;
privateNetwork = true;
hostAddress = "10.0.1.18";
localAddress = "10.0.1.51";
config = { config, pkgs, lib, ... }: {
nixpkgs.config.permittedInsecurePackages = [
"aspnetcore-runtime-6.0.36"
"aspnetcore-runtime-wrapped-6.0.36"
"dotnet-sdk-6.0.428"
"dotnet-sdk-wrapped-6.0.428"
];
nixpkgs.config.allowUnfree = true;
# Enable radarr service
services.radarr = {
enable = true;
openFirewall = true;
user = "arrs";
group = "media";
dataDir = radarrDataDir;
};
# Enable Sonarr service
services.sonarr = {
enable = true;
openFirewall = true;
user = "arrs";
group = "media";
dataDir = sonarrDataDir;
package = sonarrPkg;
};
# Enable Sabnzbd service
services.sabnzbd = {
enable = true;
openFirewall = true;
user = "arrs";
group = "media";
configFile = "${sabnzbdConfig}/sabnzbd.ini";
};
# Create required users and groups
users.users.arrs = {
isSystemUser = true;
uid = lib.mkForce arrUserId;
group = "media";
extraGroups = [ "downloads" ];
};
users.groups = {
media = { gid = lib.mkForce arrGroupId; };
downloads = {};
};
# System packages
environment.systemPackages = with pkgs; [
sqlite
mono
mediainfo
protonvpn-cli
];
# Create and set permissions for required directories
system.activationScripts.radarr-dirs = ''
mkdir -p ${radarrDataDir}
mkdir -p ${sonarrDataDir}
mkdir -p ${sabnzbdConfig}
mkdir -p ${downloadDir}
mkdir -p ${incompleteDir}
mkdir -p ${mediaDir}
chown -R arrs:media ${radarrDataDir}
chown -R arrs:media ${sonarrDataDir}
chown -R arrs:media ${sabnzbdConfig}
chown -R arrs:media ${downloadDir}
chown -R arrs:media ${incompleteDir}
chown -R arrs:media ${mediaDir}
chmod -R 775 ${radarrDataDir}
chmod -R 775 ${sonarrDataDir}
chmod -R 775 ${sabnzbdConfig}
chmod -R 775 ${downloadDir}
chmod -R 775 ${incompleteDir}
chmod -R 775 ${mediaDir}
'';
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ radarrPort sonarrPort sabnzbdPort ];
};
# Use systemd-resolved inside the container
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
system.stateVersion = "23.11";
};
# Bind mount directories from host
bindMounts = {
"${radarrDataDir}" = {
hostPath = "/media/nas/ssd/nix-app-data/radarr";
isReadOnly = false;
};
"${sonarrDataDir}" = {
hostPath = "/media/nas/ssd/nix-app-data/sonarr";
isReadOnly = false;
};
"${sabnzbdConfig}" = {
hostPath = "/media/nas/ssd/nix-app-data/sabnzbd";
isReadOnly = false;
};
"${downloadDir}" = {
hostPath = "/media/nas/ssd/ssd_app_data/downloads";
isReadOnly = false;
};
"${incompleteDir}" = {
hostPath = "/media/nas/ssd/ssd_app_data/downloads-incomplete";
isReadOnly = false;
};
"/media/movies" = {
hostPath = "/media/nas/main/movies";
isReadOnly = false;
};
"/media/tv" = {
hostPath = "/media/nas/main/tv";
isReadOnly = false;
};
};
};
networking.nat = {
forwardPorts = [
{
destination = "10.0.1.51:7878";
sourcePort = radarrPort;
}
{
destination = "10.0.1.51:8989";
sourcePort = sonarrPort;
}
{
destination = "10.0.1.51:8080";
sourcePort = sabnzbdPort;
}
];
};
}

43
modules/apps/caddy/custom-caddy.nix
View File

@@ -1,43 +0,0 @@
{
pkgs,
config,
plugins,
stdenv,
lib,
...
}:
stdenv.mkDerivation rec {
pname = "caddy";
# https://github.com/NixOS/nixpkgs/issues/113520
version = "2.7.6";
dontUnpack = true;
nativeBuildInputs = [
pkgs.git
pkgs.go
pkgs.xcaddy
];
configurePhase = ''
export GOCACHE=$TMPDIR/go-cache
export GOPATH="$TMPDIR/go"
'';
buildPhase =
let
pluginArgs = lib.concatMapStringsSep " " (plugin: "--with ${plugin}") plugins;
in
''
runHook preBuild
${pkgs.xcaddy}/bin/xcaddy build "v${version}" ${pluginArgs}
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out/bin
mv caddy $out/bin
runHook postInstall
'';
}

231
modules/apps/caddy/default.nix
View File

@@ -1,231 +0,0 @@
{ config, pkgs, ... }:
{
# Enable containers
containers.caddy = {
autoStart = true;
privateNetwork = true;
hostAddress = "10.0.1.18";
localAddress = "10.0.2.1";
config =
{ config, pkgs, ... }:
{
nixpkgs.overlays = [
(
_final: prev:
let
plugins = [ "github.com/caddy-dns/cloudflare" ];
goImports = prev.lib.flip prev.lib.concatMapStrings plugins (pkg: " _ \"${pkg}\"\n");
goGets = prev.lib.flip prev.lib.concatMapStrings plugins (pkg: "go get ${pkg}\n ");
main = ''
package main
import (
caddycmd "github.com/caddyserver/caddy/v2/cmd"
_ "github.com/caddyserver/caddy/v2/modules/standard"
${goImports}
)
func main() {
caddycmd.Main()
}
'';
in
{
caddy-cloudflare = prev.buildGoModule {
pname = "caddy-cloudflare";
version = prev.caddy.version;
runVend = true;
subPackages = [ "cmd/caddy" ];
src = prev.caddy.src;
vendorHash = "sha256-fTcMtg5GGEgclIwJCav0jjWpqT+nKw2OF1Ow0MEEitk=";
overrideModAttrs = (
_: {
preBuild = ''
echo '${main}' > cmd/caddy/main.go
${goGets}
'';
postInstall = "cp go.sum go.mod $out/ && ls $out/";
}
);
postPatch = ''
echo '${main}' > cmd/caddy/main.go
cat cmd/caddy/main.go
'';
postConfigure = ''
cp vendor/go.sum ./
cp vendor/go.mod ./
'';
meta = with prev.lib; {
homepage = "https://caddyserver.com";
description = "Fast, cross-platform HTTP/2 web server with automatic HTTPS";
license = licenses.asl20;
maintainers = with maintainers; [
Br1ght0ne
techknowlogick
];
};
};
}
)
];
systemd.services.caddy.serviceConfig.AmbientCapabilities = "CAP_NET_BIND_SERVICE";
# Caddy web server
services.caddy = {
enable = true;
email = "jalle008@proton.me";
enableReload = true;
package = pkgs.caddy-cloudflare;
adapter = "''"; # Required to enable JSON
# virtualHosts = {
# }
configFile = pkgs.writeText "Caddyfile" (
builtins.toJSON {
apps.http.servers.main = {
listen = [ ":443" ];
routes = [
{
match = [ { host = [ "authentik.mjallen.dev" ]; } ];
handle = [
{
handler = "reverse_proxy";
upstreams = [ { dial = "http://10.0.1.18:9000"; } ];
}
];
}
];
};
apps.tls.automation.policies = [
{
issuers = [
{
module = "acme";
challenges = {
dns = {
provider = {
name = "cloudflare";
api_token = "{env.CLOUDFLARE_API_TOKEN}";
};
resolvers = [ "1.1.1.1" ];
};
};
}
];
}
];
}
);
# configFile = pkgs.writeText "Caddyfile" ''
# apps.tls.automation.policies = [{
# issuers = [{
# module = "acme";
# challenges = {
# dns = {
# provider = {
# name = "cloudflare";
# api_token = "{env.CLOUDFLARE_API_TOKEN}";
# };
# resolvers = [ "1.1.1.1" ];
# };
# };
# }];
# # Wildcard certificate for all subdomains
# *.mjallen.dev {
# tls {
# dns cloudflare {env.CLOUDFLARE_API_TOKEN}
# }
# }
# :80 {
# respond "Hello from Caddy!"
# }
# :443 {
# respond "Hello from Caddy!"
# }
# authentik.mjallen.dev {
# reverse_proxy 10.0.1.18:9000
# }
# '';
};
# Environment variable for DNS challenge
environment.etc."caddy/cloudflare.env" = {
mode = "0600";
text = ''
CLOUDFLARE_API_TOKEN=HYhx7cN6e-O6QQJNKd9g7RpgvCzY-aegOPU2iQwB
'';
};
# Fail2Ban configuration
environment.etc."fail2ban/filter.d/caddy.local" = {
mode = "0644";
text = ''
[Definition]
failregex = ^<HOST> .* "(GET|POST|PUT|DELETE|HEAD|OPTIONS) .* HTTP/\d\.\d" (4\d{2}|5\d{2})
ignoreregex =
'';
};
services.fail2ban = {
enable = true;
jails = {
caddy = {
settings = {
filter = "caddy";
logpath = "/var/log/caddy/access.log";
maxretry = 5;
bantime = "30m";
};
};
};
};
# Ensure logging for Caddy
services.caddy.logDir = "/var/log/caddy";
# Open necessary firewall ports
networking.firewall = {
enable = true;
allowedTCPPorts = [
80
443
];
};
# Install additional packages if needed
environment.systemPackages = with pkgs; [
caddy
fail2ban
];
system.stateVersion = "23.11";
};
};
networking.nat = {
forwardPorts = [
{
destination = "10.0.2.1:80";
sourcePort = 80;
}
{
destination = "10.0.2.1:443";
sourcePort = 443;
}
];
};
}

30
modules/apps/jellyfin/default.nix
View File

@@ -1,30 +0,0 @@
{ lib, config, ... }:
with lib;
let
cfg = config.nas-apps.jellyfin;
in
{
imports = [ ./options.nix ];
config = mkIf cfg.enable {
virtualisation.oci-containers.containers.${cfg.name} = {
autoStart = true;
image = cfg.image;
extraOptions = [ "--device=nvidia.com/gpu=0" ];
volumes = [
"${cfg.configPath}:/config"
"${cfg.moviesPath}:/data/movies"
"${cfg.tvPath}:/data/tv"
];
ports = [ "${cfg.port}:8096" ];
environment = {
NVIDIA_VISIBLE_DEVICES = "all";
NVIDIA_DRIVER_CAPABILITIES = "all";
PUID = cfg.puid;
PGID = cfg.pgid;
TZ = cfg.timeZone;
};
};
};
}

168
modules/apps/jellyfin/jellyfin.nix
View File

@@ -1,168 +0,0 @@
{
config,
pkgs,
lib,
...
}:
# let
# jellyfinPort = 8096;
# jellyfinUserId = config.users.users.nix-apps.uid;
# jellyfinGroupId = config.users.groups.jallen-nas.gid;
# package = pkgs.jellyfin;
# in {
# containers.jellyfin = {
# autoStart = true;
# privateNetwork = true;
# hostAddress = "10.0.1.18";
# localAddress = "10.0.2.25";
# config = { config, pkgs, lib, ... }: {
# # Enable jellyfin service
# nixpkgs.config.allowUnfree = true;
# hardware = {
# # Nvidia
# nvidia = {
# package = config.boot.kernelPackages.nvidiaPackages.latest;
# # Modesetting is required.
# modesetting.enable = true;
# # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
# powerManagement.enable = true;
# # Fine-grained power management. Turns off GPU when not in use.
# # Experimental and only works on modern Nvidia GPUs (Turing or newer).
# powerManagement.finegrained = false;
# # Use the NVidia open source kernel module (not to be confused with the
# # independent third-party "nouveau" open source driver).
# # Support is limited to the Turing and later architectures. Full list of
# # supported GPUs is at:
# # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
# # Only available from driver 515.43.04+
# # Currently alpha-quality/buggy, so false is currently the recommended setting.
# open = true;
# # Enable the Nvidia settings menu,
# # accessible via `nvidia-settings`.
# nvidiaSettings = true;
# };
# # Enable graphics
# graphics = {
# enable = true;
# enable32Bit = true;
# };
# };
# # Services configs
# services.xserver = {
# # Load nvidia driver for Xorg and Wayland
# videoDrivers = [ "nvidia" ];
# };
# services.jellyfin = {
# enable = true;
# openFirewall = true;
# user = "jellyfin";
# group = "media";
# dataDir = "/data";
# configDir = "/config";
# # cacheDir = "/cache";
# };
# # Create required users and groups
# users.users.jellyfin = {
# isSystemUser = true;
# uid = lib.mkForce jellyfinUserId;
# group = "media";
# extraGroups = [ "downloads" ];
# };
# users.groups = {
# media = { gid = lib.mkForce jellyfinGroupId; };
# downloads = { };
# };
# networking = {
# firewall = {
# enable = true;
# allowedTCPPorts = [ jellyfinPort ];
# };
# # Use systemd-resolved inside the container
# # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
# useHostResolvConf = lib.mkForce false;
# };
# # System packages
# environment.systemPackages = with pkgs; [
# sqlite
# mono
# mediainfo
# # ffmpeg
# # nvidiaPackages.gpu
# # nvidiaPackages.nvidia-settings
# # nvidiaPackages.nvidia-x11
# ];
# services.resolved.enable = true;
# system.stateVersion = "23.11";
# };
# # Bind mount directories from host
# bindMounts = {
# "/data" = {
# hostPath = "/media/nas/ssd/nix-app-data/jellyfin";
# isReadOnly = false;
# };
# "/tv" = {
# hostPath = "/media/nas/main/tv";
# isReadOnly = false;
# };
# "/movies" = {
# hostPath = "/media/nas/main/movies";
# isReadOnly = false;
# };
# "/dev/nvidia0" = { hostPath = "/dev/nvidia0"; }; # GPU device
# "/dev/nvidiactl" = { hostPath = "/dev/nvidiactl"; }; # NVIDIA control
# "/dev/nvidia-modeset" = { hostPath = "/dev/nvidia-modeset"; }; # modesetting
# };
# # allowedDevices = [
# # {
# # modifier = "rw";
# # node = "/dev/nvidia0";
# # }
# # {
# # modifier = "rw";
# # node = "/dev/nvidiactl";
# # }
# # {
# # modifier = "rw";
# # node = "/dev/nvidia-modeset";
# # }
# # {
# # modifier = "rw";
# # node = "/dev/nvidia-uvm";
# # }
# # {
# # modifier = "rw";
# # node = "/dev/nvidia-uvm-tools";
# # }
# # ];
# };
# networking.nat = {
# forwardPorts = [{
# destination = "10.0.2.25:8096";
# sourcePort = jellyfinPort;
# }];
# };
# }
{
services.jellyfin = {
enable = true;
openFirewall = true;
user = "nix-apps";
group = "jallen-nas";
dataDir = "/media/nas/ssd/nix-app-data/jellyfin";
# cacheDir = "/cache";
};
}

57
modules/apps/jellyfin/options.nix
View File

@@ -1,57 +0,0 @@
{ lib, ... }:
with lib;
{
options.nas-apps.jellyfin = {
enable = mkEnableOption "jellyfin docker service";
autoStart = mkOption {
type = types.bool;
default = true;
};
port = mkOption {
type = types.str;
default = "8096";
};
name = mkOption {
type = types.str;
default = "jellyfin";
};
image = mkOption {
type = types.str;
default = "lscr.io/linuxserver/jellyfin";
};
configPath = mkOption {
type = types.str;
default = "/media/nas/ssd/nix-app-data/jellyfin";
};
moviesPath = mkOption {
type = types.str;
default = "/media/nas/main/movies";
};
tvPath = mkOption {
type = types.str;
default = "/media/nas/main/tv";
};
puid = mkOption {
type = types.str;
default = "911";
};
pgid = mkOption {
type = types.str;
default = "1000";
};
timeZone = mkOption {
type = types.str;
default = "America/Chicago";
};
};
}

22
modules/apps/jellyseerr/default.nix
View File

@@ -1,22 +0,0 @@
{ lib, config, ... }:
with lib;
let
cfg = config.nas-apps.jellyseerr;
in
{
imports = [ ./options.nix ];
config = mkIf cfg.enable {
virtualisation.oci-containers.containers."${cfg.name}" = {
autoStart = cfg.autoStart;
image = cfg.image;
ports = [ "${cfg.port}:5055" ];
volumes = [ "${cfg.configPath}:/app/config" ];
environment = {
PUID = cfg.puid;
PGID = cfg.pgid;
TZ = cfg.timeZone;
};
};
};
}

65
modules/apps/jellyseerr/jellyseerr.nix
View File

@@ -1,65 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
jellyseerrPort = 5055;
dataDir = "/var/lib/jellyseerr";
downloadDir = "/downloads";
mediaDir = "/media";
jellyseerrUserId = config.users.users.nix-apps.uid;
jellyseerrGroupId = config.users.groups.jallen-nas.gid;
package = pkgs.jellyseerr;
in
{
containers.jellyseerr = {
autoStart = true;
privateNetwork = true;
hostAddress = "10.0.1.18";
localAddress = "10.0.1.52";
hostAddress6 = "fc00::1";
localAddress6 = "fc00::4";
config =
{
config,
pkgs,
lib,
...
}:
{
# Enable jellyseerr service
services.jellyseerr = {
enable = true;
port = jellyseerrPort;
# package = package;
openFirewall = true;
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ jellyseerrPort ];
};
# Use systemd-resolved inside the container
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
system.stateVersion = "23.11";
};
};
networking.nat = {
forwardPorts = [
{
destination = "10.0.1.52:5055";
sourcePort = jellyseerrPort;
}
];
};
}

47
modules/apps/jellyseerr/options.nix
View File

@@ -1,47 +0,0 @@
{ lib, ... }:
with lib;
{
options.nas-apps.jellyseerr = {
enable = mkEnableOption "jellyseerr docker service";
autoStart = mkOption {
type = types.bool;
default = true;
};
port = mkOption {
type = types.str;
default = "5055";
};
name = mkOption {
type = types.str;
default = "jellyseerr";
};
image = mkOption {
type = types.str;
default = "fallenbagel/jellyseerr";
};
configPath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/jellyseerr";
};
puid = mkOption {
type = types.str;
default = "911";
};
pgid = mkOption {
type = types.str;
default = "1000";
};
timeZone = mkOption {
type = types.str;
default = "America/Chicago";
};
};
}

106
modules/apps/paperless/default.nix
View File

@@ -1,106 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
paperlessPort = 28981;
paperlessUserId = config.users.users.nix-apps.uid;
paperlessGroupId = config.users.groups.jallen-nas.gid;
passwordFile = config.sops.secrets."jallen-nas/admin_password".path;
in
{
containers.paperless = {
autoStart = true;
privateNetwork = true;
hostAddress = "10.0.1.18";
localAddress = "10.0.1.20";
hostAddress6 = "fc00::1";
localAddress6 = "fc00::20";
config =
{
config,
pkgs,
lib,
...
}:
{
# Enable paperless service
services.paperless = {
enable = true;
port = paperlessPort;
user = "paperless";
address = "0.0.0.0";
passwordFile = "/var/lib/paperless/paperless-password";
# settings = {
# PAPERLESS_APPS="allauth.socialaccount.providers.openid_connect";
# PAPERLESS_SOCIALACCOUNT_PROVIDERS = {
# "openid_connect" = {
# "OAUTH_PKCE_ENABLED":true,
# "APPS":[
# {"provider_id":"authentik","name":"Authentik","client_id":"<Client ID>","secret":<Client Secret>","settings":{"server_url":"https://authentik.mjallen.dev/application/o/paperless/.well-known/openid-configuration"}}]}}
# }
};
# Create required users and groups
users.groups = {
documents = {
gid = lib.mkForce paperlessGroupId;
};
};
users.users.paperless = {
isSystemUser = true;
uid = lib.mkForce paperlessUserId;
group = lib.mkForce "documents";
};
# Create and set permissions for required directories
system.activationScripts.paperless-dirs = ''
mkdir -p /var/lib/paperless
chown -R paperless:documents /var/lib/paperless
chmod -R 775 /var/lib/paperless
'';
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ paperlessPort ];
};
# Use systemd-resolved inside the container
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
system.stateVersion = "23.11";
};
# Bind mount directories from host
bindMounts = {
"/var/lib/paperless" = {
hostPath = "/media/nas/ssd/nix-app-data/paperless";
isReadOnly = false;
};
# "/run/keys/paperless-password" = {
# hostPath = passwordFile;
# isReadOnly = true;
# };
};
};
networking.nat = {
forwardPorts = [
{
destination = "10.0.1.20:28981";
sourcePort = paperlessPort;
}
];
};
}

28
modules/apps/sabnzbd/default.nix
View File

@@ -1,28 +0,0 @@
{ lib, config, ... }:
with lib;
let
cfg = config.nas-apps.sabnzbd;
in
{
imports = [ ./options.nix ];
config = mkIf cfg.enable {
virtualisation.oci-containers.containers."${cfg.name}" = {
autoStart = cfg.autoStart;
image = cfg.image;
ports = [ "${cfg.port}:8080" ];
volumes = [
"${cfg.configPath}:/config"
"${cfg.moviesPath}:/movies"
"${cfg.tvPath}:/tv"
"${cfg.downloadsPath}:/downloads"
"${cfg.downloadsIncompletePath}:/downloads-incomplete"
];
environment = {
PUID = cfg.puid;
PGID = cfg.pgid;
TZ = cfg.timeZone;
};
};
};
}

67
modules/apps/sabnzbd/options.nix
View File

@@ -1,67 +0,0 @@
{ lib, ... }:
with lib;
{
options.nas-apps.sabnzbd = {
enable = mkEnableOption "sabnzbd docker service";
autoStart = mkOption {
type = types.bool;
default = true;
};
port = mkOption {
type = types.str;
default = "8080";
};
name = mkOption {
type = types.str;
default = "sabnzbd";
};
image = mkOption {
type = types.str;
default = "linuxserver/sabnzbd";
};
configPath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/sabnzbd";
};
moviesPath = mkOption {
type = types.str;
default = "/media/nas/main/movies";
};
tvPath = mkOption {
type = types.str;
default = "/media/nas/main/tv";
};
downloadsPath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/downloads";
};
downloadsIncompletePath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/downloads-incomplete";
};
puid = mkOption {
type = types.str;
default = "911";
};
pgid = mkOption {
type = types.str;
default = "1000";
};
timeZone = mkOption {
type = types.str;
default = "America/Chicago";
};
};
}

57
modules/apps/sabnzbd/sabnzbd.nix
View File

@@ -1,57 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
sabnzbdPort = 8080;
dataDir = "/var/lib/sabnzbd";
downloadDir = "/downloads";
mediaDir = "/media";
sabnzbdUserId = config.users.users.nix-apps.uid;
sabnzbdGroupId = config.users.groups.jallen-nas.gid;
package = pkgs.sabnzbd;
in
{
containers.sabnzbd = {
autoStart = true;
privateNetwork = true;
hostAddress = "10.0.1.18";
localAddress = "10.0.2.20";
config =
{
config,
pkgs,
lib,
...
}:
{
# Enable sabnzbd service
services.sabnzbd = {
enable = true;
openFirewall = true;
};
networking = {
# Use systemd-resolved inside the container
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
system.stateVersion = "23.11";
};
};
networking.nat = {
forwardPorts = [
{
destination = "10.0.2.20:8080";
sourcePort = sabnzbdPort;
}
];
};
}

26
modules/apps/sonarr/default.nix
View File

@@ -1,26 +0,0 @@
{ lib, config, ... }:
with lib;
let
cfg = config.nas-apps.sonarr;
in
{
imports = [ ./options.nix ];
config = mkIf cfg.enable {
virtualisation.oci-containers.containers."${cfg.name}" = {
autoStart = cfg.autoStart;
image = cfg.image;
ports = [ "${cfg.port}:8989" ];
volumes = [
"${cfg.configPath}:/config"
"${cfg.tvPath}:/tv"
"${cfg.downloadsPath}:/downloads"
];
environment = {
PUID = cfg.puid;
PGID = cfg.pgid;
TZ = cfg.timeZone;
};
};
};
}

57
modules/apps/sonarr/options.nix
View File

@@ -1,57 +0,0 @@
{ lib, ... }:
with lib;
{
options.nas-apps.sonarr = {
enable = mkEnableOption "sonarr docker service";
autoStart = mkOption {
type = types.bool;
default = true;
};
port = mkOption {
type = types.str;
default = "8989";
};
name = mkOption {
type = types.str;
default = "sonarr";
};
image = mkOption {
type = types.str;
default = "linuxserver/sonarr";
};
configPath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/sonarr";
};
tvPath = mkOption {
type = types.str;
default = "/media/nas/main/tv";
};
downloadsPath = mkOption {
type = types.str;
default = "/media/nas/ssd/ssd_app_data/downloads";
};
puid = mkOption {
type = types.str;
default = "911";
};
pgid = mkOption {
type = types.str;
default = "1000";
};
timeZone = mkOption {
type = types.str;
default = "America/Chicago";
};
};
}

118
modules/apps/sonarr/sonarr.nix
View File

@@ -1,118 +0,0 @@
# {
# config,
# pkgs,
# lib,
# ...
# }:
# let
# sonarrPort = 8989;
# dataDir = "/var/lib/sonarr";
# downloadDir = "/downloads";
# mediaDir = "/media";
# sonarrUserId = config.users.users.nix-apps.uid;
# sonarrGroupId = config.users.groups.jallen-nas.gid;
# in
# {
# containers.sonarr = {
# autoStart = true;
# privateNetwork = true;
# hostAddress = "10.0.1.18";
# localAddress = "10.0.1.50";
# hostAddress6 = "fc00::1";
# localAddress6 = "fc00::2";
# config =
# {
# config,
# pkgs,
# lib,
# ...
# }:
# {
# # Enable Sonarr service
# services.sonarr = {
# enable = true;
# user = "sonarr";
# group = "media";
# dataDir = dataDir;
# };
# # Create required users and groups
# users.users.sonarr = {
# isSystemUser = true;
# uid = lib.mkForce sonarrUserId;
# group = "media";
# extraGroups = [ "downloads" ];
# };
# users.groups = {
# media = {
# gid = lib.mkForce sonarrGroupId;
# };
# downloads = { };
# };
# # System packages
# environment.systemPackages = with pkgs; [
# sqlite
# mono
# mediainfo
# ];
# # Create and set permissions for required directories
# system.activationScripts.sonarr-dirs = ''
# mkdir -p ${dataDir}
# mkdir -p ${downloadDir}
# mkdir -p ${mediaDir}
# chown -R sonarr:media ${dataDir}
# chown -R sonarr:media ${downloadDir}
# chown -R sonarr:media ${mediaDir}
# chmod -R 775 ${dataDir}
# chmod -R 775 ${downloadDir}
# chmod -R 775 ${mediaDir}
# '';
# networking = {
# firewall = {
# enable = true;
# allowedTCPPorts = [ sonarrPort ];
# };
# # Use systemd-resolved inside the container
# # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
# useHostResolvConf = lib.mkForce false;
# };
# services.resolved.enable = true;
# system.stateVersion = "23.11";
# };
# # Bind mount directories from host
# bindMounts = {
# "/var/lib/sonarr" = {
# hostPath = "/media/nas/ssd/nix-app-data/sonarr";
# isReadOnly = false;
# };
# "/downloads" = {
# hostPath = "/media/nas/ssd/ssd_app_data/downloads";
# isReadOnly = false;
# };
# "/media" = {
# hostPath = "/media/nas/main/tv";
# isReadOnly = false;
# };
# };
# };
# networking.nat = {
# forwardPorts = [
# {
# destination = "10.0.1.50:8989";
# sourcePort = 8989;
# }
# ];
# };
# }

3
modules/default.nix
View File

@@ -2,14 +2,11 @@
{
imports = [
./samba
./apps/arrs
./apps/collabora
./apps/deluge
./apps/discover-wrapped
./apps/free-games-claimer
./apps/jackett
./apps/jellyfin
./apps/jellyseerr
./apps/manyfold
./apps/mariadb
./apps/mongodb

128
modules/services/nextcloud/default.nix
View File

@@ -1,128 +0,0 @@
{ config, ... }:
let
adminpass = config.sops.secrets."jallen-nas/nextcloud/adminpassword".path;
dbpass = config.sops.secrets."jallen-nas/nextcloud/dbpassword".path;
smtppassword = config.sops.templates."nextcloud-smtp".content;
in
{
containers.nextcloud = {
autoStart = true;
privateNetwork = true;
# hostAddress = "127.0.0.1";
# localAddress = "10.233.0.2";
# hostAddress6 = "fc00::1";
# localAddress6 = "fc00::2";
# hostForward = [
# {
# hostPort = 9943;
# containerPort = 80;
# }
# ];
hostBridge = "br0";
bindMounts = {
secrets = {
hostPath = "/run/secrets/jallen-nas/nextcloud";
isReadOnly = true;
mountPoint = "/run/secrets/jallen-nas/nextcloud";
};
data = {
hostPath = "/media/nas/main/nextcloud";
isReadOnly = false;
mountPoint = "/data";
};
};
config =
{ pkgs, lib, ... }:
{
services = {
nextcloud = {
enable = true;
package = pkgs.nextcloud29;
datadir = "/data";
hostName = "localhost";
appstoreEnable = true;
caching.redis = true;
configureRedis = true;
config = {
adminuser = "mjallen";
adminpassFile = adminpass;
dbhost = "10.0.1.18:3306";
dbtype = "mysql";
dbname = "jallen_nextcloud";
dbuser = "nextcloud";
dbpassFile = dbpass;
};
settings = {
trusted_domains = [
"10.0.1.18:9980"
"10.0.1.18:9943"
"cloud.mjallen.dev"
];
trusted_proxies = [ "10.0.1.18" ];
maintenance_window_start = 6;
default_phone_region = "US";
mail_from_address = "matt.l.jallen";
mail_smtpmode = "smtp";
mail_sendmailmode = "smtp";
mail_domain = "gmail.com";
mail_smtpauth = 1;
mail_smtpname = "matt.l.jallen";
mail_smtppassword = smtppassword;
mail_smtpsecure = "ssl";
mail_smtphost = "smtp.gmail.com";
mail_smtpport = 465;
enable_previews = true;
enabledPreviewProviders = [
"OC\\\\Preview\\\\PNG"
"OC\\\\Preview\\\\JPEG"
"OC\\\\Preview\\\\GIF"
"OC\\\\Preview\\\\BMP"
"OC\\\\Preview\\\\XBitmap"
"OC\\\\Preview\\\\MP3"
"OC\\\\Preview\\\\TXT"
"OC\\\\Preview\\\\MarkDown"
"OC\\\\Preview\\\\OpenDocument"
"OC\\\\Preview\\\\Krita"
"OC\\\\Preview\\\\HEIC"
];
};
};
nginx = {
enable = true;
virtualHosts = {
"nextcloud-container.local" = {
# Change this to the desired port number
listen = [
{
addr = "0.0.0.0";
port = 9943;
}
];
root = "/var/www/nextcloud";
# You may need to adjust other options for your specific setup
};
};
};
};
system.stateVersion = "23.11";
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 9943 ];
};
# Use systemd-resolved inside the container
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
};
};
}