udpate 24.11

modules/apps/jellyseerr/jellyseerr.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, lib, ... }:
+
+let
+  jellyseerrPort = 5055;
+  dataDir = "/var/lib/jellyseerr";
+  downloadDir = "/downloads";
+  mediaDir = "/media";
+  jellyseerrUserId = config.users.users.nix-apps.uid;
+  jellyseerrGroupId = config.users.groups.jallen-nas.gid;
+  package = pkgs.unstable.jellyseerr;
+in
+{
+  containers.jellyseerr = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.0.1.18";
+    localAddress = "10.0.1.52";
+    hostAddress6 = "fc00::1";
+    localAddress6 = "fc00::4";
+    
+    config = { config, pkgs, lib, ... }: {
+      # Enable jellyseerr service
+      services.jellyseerr = {
+        enable = true;
+        port = jellyseerrPort;
+        # package = package;
+        openFirewall = true;
+      };
+
+      networking = {
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [ jellyseerrPort ];
+        };
+        # Use systemd-resolved inside the container
+        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        useHostResolvConf = lib.mkForce false;
+      };
+      
+      services.resolved.enable = true;
+      system.stateVersion = "23.11";
+    };
+  };
+
+  networking.nat = {
+    forwardPorts = [
+      {
+        destination = "10.0.1.52:5055";
+        sourcePort = jellyseerrPort;
+      }
+    ];
+  };
+}

modules/apps/radarr/radarr.nix

@@ -0,0 +1,106 @@
+{ config, pkgs, lib, ... }:
+
+let
+  radarrPort = 7878;
+  dataDir = "/var/lib/radarr";
+  downloadDir = "/downloads";
+  mediaDir = "/media";
+  radarrUserId = config.users.users.nix-apps.uid;
+  radarrGroupId = config.users.groups.jallen-nas.gid;
+  package = pkgs.unstable.radarr;
+in
+{
+  containers.radarr = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.0.1.18";
+    localAddress = "10.0.1.51";
+    hostAddress6 = "fc00::1";
+    localAddress6 = "fc00::3";
+    
+    config = { config, pkgs, lib, ... }: {
+      # Enable radarr service
+      services.radarr = {
+        enable = true;
+        user = "radarr";
+        group = "media";
+        dataDir = dataDir;
+        package = package;
+      };
+
+      # Create required users and groups
+      users.users.radarr = {
+        isSystemUser = true;
+        uid = lib.mkForce radarrUserId;
+        group = "media";
+        extraGroups = [ "downloads" ];
+      };
+
+      users.groups = {
+        media = { gid = lib.mkForce radarrGroupId; };
+        downloads = {};
+      };
+
+      # System packages
+      environment.systemPackages = with pkgs; [
+        sqlite
+        mono
+        mediainfo
+      ];
+
+      # Create and set permissions for required directories
+      system.activationScripts.radarr-dirs = ''
+        mkdir -p ${dataDir}
+        mkdir -p ${downloadDir}
+        mkdir -p ${mediaDir}
+
+        chown -R radarr:media ${dataDir}
+        chown -R radarr:media ${downloadDir}
+        chown -R radarr:media ${mediaDir}
+        
+        chmod -R 775 ${dataDir}
+        chmod -R 775 ${downloadDir}
+        chmod -R 775 ${mediaDir}
+        
+      '';
+
+      networking = {
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [ radarrPort ];
+        };
+        # Use systemd-resolved inside the container
+        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        useHostResolvConf = lib.mkForce false;
+      };
+      
+      services.resolved.enable = true;
+      system.stateVersion = "23.11";
+    };
+
+    # Bind mount directories from host
+    bindMounts = {
+      "/var/lib/radarr" = {
+        hostPath = "/media/nas/ssd/nix-app-data/radarr";
+        isReadOnly = false;
+      };
+      "/downloads" = {
+        hostPath = "/media/nas/ssd/ssd_app_data/downloads";
+        isReadOnly = false;
+      };
+      "/media" = {
+        hostPath = "/media/nas/main/movies";
+        isReadOnly = false;
+      };
+    };
+  };
+
+  networking.nat = {
+    forwardPorts = [
+      {
+        destination = "10.0.1.51:7878";
+        sourcePort = radarrPort;
+      }
+    ];
+  };
+}

modules/apps/sonarr/sonarr.nix

@@ -0,0 +1,104 @@
+{ config, pkgs, lib, ... }:
+
+let
+  sonarrPort = 8989;
+  dataDir = "/var/lib/sonarr";
+  downloadDir = "/downloads";
+  mediaDir = "/media";
+  sonarrUserId = config.users.users.nix-apps.uid;
+  sonarrGroupId = config.users.groups.jallen-nas.gid;
+in
+{
+  containers.sonarr = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.0.1.18";
+    localAddress = "10.0.1.50";
+    hostAddress6 = "fc00::1";
+    localAddress6 = "fc00::2";
+    
+    config = { config, pkgs, lib, ... }: {
+      # Enable Sonarr service
+      services.sonarr = {
+        enable = true;
+        user = "sonarr";
+        group = "media";
+        dataDir = dataDir;
+      };
+
+      # Create required users and groups
+      users.users.sonarr = {
+        isSystemUser = true;
+        uid = lib.mkForce sonarrUserId;
+        group = "media";
+        extraGroups = [ "downloads" ];
+      };
+
+      users.groups = {
+        media = { gid = lib.mkForce sonarrGroupId; };
+        downloads = {};
+      };
+
+      # System packages
+      environment.systemPackages = with pkgs; [
+        sqlite
+        mono
+        mediainfo
+      ];
+
+      # Create and set permissions for required directories
+      system.activationScripts.sonarr-dirs = ''
+        mkdir -p ${dataDir}
+        mkdir -p ${downloadDir}
+        mkdir -p ${mediaDir}
+
+        chown -R sonarr:media ${dataDir}
+        chown -R sonarr:media ${downloadDir}
+        chown -R sonarr:media ${mediaDir}
+        
+        chmod -R 775 ${dataDir}
+        chmod -R 775 ${downloadDir}
+        chmod -R 775 ${mediaDir}
+        
+      '';
+
+      networking = {
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [ sonarrPort ];
+        };
+        # Use systemd-resolved inside the container
+        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        useHostResolvConf = lib.mkForce false;
+      };
+      
+      services.resolved.enable = true;
+      system.stateVersion = "23.11";
+    };
+
+    # Bind mount directories from host
+    bindMounts = {
+      "/var/lib/sonarr" = {
+        hostPath = "/media/nas/ssd/nix-app-data/sonarr";
+        isReadOnly = false;
+      };
+      "/downloads" = {
+        hostPath = "/media/nas/ssd/ssd_app_data/downloads";
+        isReadOnly = false;
+      };
+      "/media" = {
+        hostPath = "/media/nas/main/tv";
+        isReadOnly = false;
+      };
+    };
+  };
+
+  networking.nat = {
+    forwardPorts = [
+      {
+        destination = "10.0.1.50:8989";
+        sourcePort = 8989;
+      }
+    ];
+  };
+}

modules/samba/default.nix

@@ -1,7 +1,9 @@
-{ lib, pkgs, config, ... }:
+{ lib, config, ... }:
 with lib;
-let cfg = config.nas-samba;
-in {
+let
+  cfg = config.nas-samba;
+in
+{
   imports = [ ./options.nix ];
 
   config = mkIf cfg.enable {
@@ -22,42 +24,50 @@ in {
       };
     };
 
+    networking.firewall.enable = true;
+    networking.firewall.allowPing = true;
+
     services.samba = {
       enable = true;
-      securityType = "user";
       openFirewall = true;
-      extraConfig = ''
-        workgroup = WORKGROUP
-        server string = smbnix
-        netbios name = smbnix
-        security = user 
-        #use sendfile = yes
-        #max protocol = smb2
-        # note: localhost is the ipv6 localhost ::1
-        hosts allow = ${cfg.hostsAllow} 127.0.0.1 localhost
-        hosts deny = 0.0.0.0/0
-        guest account = nobody
-        map to guest = bad user
-        force user = nix-apps
-      '';
-      shares = let
-        make = name: share:
-          nameValuePair "${name}" {
-            path = share.sharePath;
-            public = if share.enableTimeMachine then "no" else "yes";
-            browseable = if share.browseable then "yes" else "no";
-            writable = "yes";
-            "read only" = if share.readOnly then "yes" else "no";
-            "guest ok" = if share.guestOk then "yes" else "no";
-            "create mask" = share.createMask;
-            "directory mask" = share.directoryMask;
-            "fruit:aapl" = if share.enableTimeMachine then "yes" else "no";
-            "fruit:time machine" = if share.enableTimeMachine then "yes" else "no";
-            "vfs objects" = "catia fruit streams_xattr";
-            "fruit:time machine max size" = share.timeMachineMaxSize;
-          };
-      in mapAttrs' make cfg.shares;
+      # settings = {
+      #   create-mode = 664;
+      #   force directory mode = 2770
+      #   workgroup = WORKGROUP
+      #   server string = jallen-nas
+      #   netbios name = jallen-nas
+      #   security = user 
+      #   #use sendfile = yes
+      #   #max protocol = smb2
+      #   # note: localhost is the ipv6 localhost ::1
+      #   hosts allow = ${cfg.hostsAllow} 127.0.0.1 localhost
+      #   hosts deny = 0.0.0.0/0
+      #   guest account = nobody
+      #   map to guest = bad user
+      #   usershare allow guests = yes
+      # };
+      settings =
+        let
+          make =
+            name: share:
+            nameValuePair "${name}" {
+              path = share.sharePath;
+              public = if share.enableTimeMachine then "no" else "yes";
+              private = if !share.public || share.enableTimeMachine then "yes" else "no";
+              browseable = if share.browseable then "yes" else "no";
+              writable = "yes";
+              "force group" = "jallen-nas";
+              "read only" = if share.readOnly then "yes" else "no";
+              "guest ok" = if share.guestOk then "yes" else "no";
+              "create mask" = share.createMask;
+              "directory mask" = share.directoryMask;
+              "fruit:aapl" = if share.enableTimeMachine then "yes" else "no";
+              "fruit:time machine" = if share.enableTimeMachine then "yes" else "no";
+              "vfs objects" = "catia fruit streams_xattr";
+              "fruit:time machine max size" = share.timeMachineMaxSize;
+            };
+        in
+        mapAttrs' make cfg.shares;
     };
   };
 }
-            # private = if !share.public || share.enableTimeMachine then "yes" else "no";