mkModule migration begin

lib/module/default.nix

@@ -48,6 +48,12 @@ rec {
           reverseProxies = [ reverseProxyConfig ];
         };
 
+        # Open firewall
+        networking.firewall = lib.mkIf cfg.openFirewall {
+          allowedTCPPorts = [ cfg.port ];
+          allowedUDPPorts = [ cfg.port ];
+        };
+
         users = lib.mkIf cfg.createUser {
           users.${name} = {
             isSystemUser = true;
@@ -57,6 +63,19 @@ rec {
           groups.${name} = { };
         };
 
+        services = {
+          # postgresql = lib.mkIf cfg.configureDb {
+          #   enable = true;
+          #   ensureDatabases = [ name ];
+          #   ensureUsers = [
+          #     {
+          #       name = name;
+          #       ensureDBOwnership = true;
+          #     }
+          #   ];
+          # };
+        };
+
         systemd.tmpfiles.rules = [
           "d ${cfg.configDir} 0700 ${name} ${name} - -"
           "d ${cfg.configDir}/server-files 0700 ${name} ${name} - -"
@@ -73,12 +92,26 @@ rec {
 
             port = mkOpt types.int 80 "Port for ${name} to be hosted on";
 
-            configDir = mkOpt types.str "/media/nas/main/nix-app-data/${name}" "Path to the config dir";
+            configDir = mkOpt types.str "/media/nas/main/nix-app-data" "Path to the config dir";
 
-            dataDir = mkOpt types.str "/media/nas/main/${name}" "Path to the data dir";
+            dataDir = mkOpt types.str "/media/nas/main" "Path to the data dir";
 
             createUser = mkBoolOpt false "create a user for this module/service";
 
+            configureDb = mkBoolOpt false "Manage db for this service";
+
+            environmentFile = mkOpt types.str "" "Environment File";
+
+            puid = mkOpt types.str "911" "default user id";
+
+            pgid = mkOpt types.str "1000" "default group id";
+
+            timeZone = mkOpt types.str "America/Chicago" "default timezone";
+
+            listenAddress = mkOpt types.str "0.0.0.0" "Environment File";
+
+            openFirewall = mkBoolOpt true "Open the firewall";
+
             reverseProxy = mkReverseProxyOpt;
           }
           // options;

modules/nixos/services/actual/default.nix

@@ -10,29 +10,29 @@ let
   name = "actual";
   cfg = config.${namespace}.services.${name};
 
-  actualConfig = lib.${namespace}.mkModule rec {
+  actualConfig = lib.${namespace}.mkModule {
-    inherit name;
+    inherit config name;
     description = "Actual Personal Finance Planner";
     options = { };
     moduleConfig = {
       services.actual = {
         enable = true;
-        openFirewall = true;
+        openFirewall = cfg.openFirewall;
         settings = {
           trustedProxies = [ config.${namespace}.network.ipv4.address ];
           port = cfg.port;
-          configDir = cfg.configDir;
+          configDir = "${cfg.configDir}/${name}";
-          serverFiles = "${cfg.configDir}/server-files";
+          serverFiles = "${cfg.configDir}/${name}/server-files";
-          userFiles = "${cfg.configDir}/user-files";
+          userFiles = "${cfg.configDir}/${name}/user-files";
         };
       };
 
       systemd.services = lib.mkIf cfg.createUser {
         actual = {
-          environment.ACTUAL_CONFIG_PATH = lib.mkForce "${cfg.configDir}/config.json";
+          environment.ACTUAL_CONFIG_PATH = lib.mkForce "${cfg.configDir}/${name}/config.json";
           serviceConfig = {
-            ExecStart = lib.mkForce "${lib.getExe pkgs.actual-server} --config ${cfg.configDir}/config.json";
+            ExecStart = lib.mkForce "${lib.getExe pkgs.actual-server} --config ${cfg.configDir}/${name}/config.json";
-            WorkingDirectory = lib.mkForce cfg.configDir;
+            WorkingDirectory = lib.mkForce "${cfg.configDir}/${name}";
             StateDirectoryMode = lib.mkForce 700;
             DynamicUser = lib.mkForce false;
             ProtectSystem = lib.mkForce "full";
@@ -40,7 +40,6 @@ let
         };
       };
     };
-    inherit config;
   };
 in
 {

modules/nixos/services/ai/default.nix

@@ -7,31 +7,34 @@
 }:
 with lib;
 let
-  cfg = config.${namespace}.services.ai;
+  name = "ai";
-in
+  cfg = config.${namespace}.services.${name};
-{
-  imports = [ ./options.nix ];
 
-  config = mkIf cfg.enable {
+  aiConfig = lib.${namespace}.mkModule {
-    services.ollama = {
+    inherit config name;
+    description = "AI Services";
+    options = { };
+    moduleConfig = {
+      services = {
+        ollama = {
           enable = true;
           package = pkgs.stable.ollama-rocm;
           port = 11434;
           host = "0.0.0.0";
           user = "nix-apps";
           group = "jallen-nas";
-      openFirewall = true;
+          openFirewall = cfg.openFirewall;
           rocmOverrideGfx = "11.0.2";
           loadModels = [ "mistral:instruct" ];
-      home = "/media/nas/main/nix-app-data/ollama";
+          home = "${cfg.configDir}/ollama";
         };
 
-    services.llama-cpp = {
+        llama-cpp = {
           enable = true;
           port = 8127;
           host = "0.0.0.0";
-      openFirewall = true;
+          openFirewall = cfg.openFirewall;
-      model = "/media/nas/main/nix-app-data/llama-cpp/models/functionary-small-v3.2-GGUF/functionary-small-v3.2.Q4_0.gguf";
+          model = "${cfg.configDir}/llama-cpp/models/functionary-small-v3.2-GGUF/functionary-small-v3.2.Q4_0.gguf";
           package = pkgs.stable.llama-cpp-rocm;
           extraFlags = [
             "--n_gpu-layers"
@@ -44,12 +47,12 @@ in
           ];
         };
 
-    services.open-webui = {
+        open-webui = {
           enable = true;
           package = pkgs.stable.open-webui;
           host = "0.0.0.0";
           port = 8888;
-      openFirewall = true;
+          openFirewall = cfg.openFirewall;
           # stateDir = "/media/nas/main/nix-app-data/open-webui";
           environmentFile = config.sops.secrets."jallen-nas/open-webui".path;
           environment = {
@@ -69,4 +72,9 @@ in
           };
         };
       };
+    };
+  };
+in
+{
+  imports = [ aiConfig ];
 }

modules/nixos/services/ai/options.nix

@@ -1,7 +0,0 @@
-{ lib, namespace, ... }:
-with lib;
-{
-  options.${namespace}.services.ai = {
-    enable = mkEnableOption "enable ai";
-  };
-}

modules/nixos/services/arrs/default.nix

@@ -6,57 +6,63 @@
 }:
 with lib;
 let
-  cfg = config.${namespace}.services.arrs;
+  name = "arrs";
-in
+  cfg = config.${namespace}.services.${name};
-{
-  imports = [ ./options.nix ];
 
-  config = mkIf cfg.enable {
+  arrsConfig = lib.${namespace}.mkModule {
+    inherit config name;
+    description = "*arr Services";
+    options = { };
+    moduleConfig = {
       # Enable radarr service
       services.radarr = {
-      enable = cfg.radarr.enable;
+        enable = true;
-      openFirewall = true;
+        openFirewall = cfg.openFirewall;
         user = "nix-apps";
         group = "jallen-nas";
-      dataDir = cfg.radarr.dataDir;
+        dataDir = "${cfg.configDir}/radarr";
       };
 
       # Enable Sonarr service
       services.sonarr = {
-      enable = cfg.sonarr.enable;
+        enable = true;
-      openFirewall = true;
+        openFirewall = cfg.openFirewall;
         user = "nix-apps";
         group = "jallen-nas";
-      dataDir = cfg.sonarr.dataDir;
+        dataDir = "${cfg.configDir}/sonarr";
       };
 
       # Enable Sabnzbd service
       services.sabnzbd = {
-      enable = cfg.sabnzbd.enable;
+        enable = true;
-      # openFirewall = true;
+        # openFirewall = cfg.openFirewall;
         user = "nix-apps";
         group = "jallen-nas";
-      configFile = "${cfg.sabnzbd.dataDir}/sabnzbd.ini";
+        configFile = "${cfg.configDir}/sabnzbd/sabnzbd.ini";
       };
 
       services.deluge = {
-      enable = cfg.deluge.enable;
+        enable = false;
         user = "nix-apps";
         group = "jallen-nas";
-      openFirewall = true;
+        openFirewall = cfg.openFirewall;
-      dataDir = "/media/nas/main";
+        dataDir = cfg.dataDir;
         web = {
           enable = true;
-        port = cfg.deluge.port;
+          port = 8112;
-        openFirewall = true;
+          openFirewall = cfg.openFirewall;
         };
       };
 
       services.jackett = {
-      enable = cfg.jackett.enable;
+        enable = false;
         user = "nix-apps";
         group = "jallen-nas";
-      openFirewall = true;
+        openFirewall = cfg.openFirewall;
       };
     };
+  };
+in
+{
+  imports = [ arrsConfig ];
 }

modules/nixos/services/arrs/default.nix.container

@@ -1,261 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  namespace,
-  ...
-}:
-with lib;
-let
-  cfg = config.${namespace}.services.arrs;
-  radarrDataDir = "/var/lib/radarr";
-  downloadDir = "/downloads";
-  incompleteDir = "/downloads-incomplete";
-  sonarrDataDir = "/var/lib/sonarr";
-  sabnzbdConfig = "/var/lib/sabnzbd";
-  jackettDir = "/var/lib/jackett/.config/Jackett";
-  mediaDir = "/media";
-  arrUserId = config.users.users.nix-apps.uid;
-  arrGroupId = config.users.groups.jallen-nas.gid;
-  radarrPkg = pkgs.radarr;
-  sonarrPkg = pkgs.sonarr;
-  delugePkg = pkgs.deluge;
-  jackettPkg = pkgs.jackett;
-in
-{
-  imports = [ ./options.nix ];
-
-  config = mkIf cfg.enable {
-    containers.arrs = {
-      autoStart = true;
-      privateNetwork = true;
-      hostAddress = "10.0.1.3";
-      localAddress = cfg.localAddress;
-
-      config =
-        {
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          nixpkgs.config = {
-            allowUnfree = lib.mkForce true;
-            allowUnfreePredicate =
-              pkg:
-              builtins.elem (lib.getName pkg) [
-                "unrar"
-              ];
-          };
-
-          # Enable radarr service
-          services.radarr = {
-            enable = cfg.radarr.enable;
-            openFirewall = true;
-            user = "arrs";
-            group = "media";
-            dataDir = radarrDataDir;
-            package = radarrPkg;
-          };
-
-          # Enable Sonarr service
-          services.sonarr = {
-            enable = cfg.sonarr.enable;
-            openFirewall = true;
-            user = "arrs";
-            group = "media";
-            dataDir = sonarrDataDir;
-            package = sonarrPkg;
-          };
-
-          # Enable Sabnzbd service
-          services.sabnzbd = {
-            enable = cfg.sabnzbd.enable;
-            openFirewall = true;
-            user = "arrs";
-            group = "media";
-            configFile = "${sabnzbdConfig}/sabnzbd.ini";
-            package = pkgs.sabnzbd;
-          };
-
-          services.deluge = {
-            enable = cfg.deluge.enable;
-            user = "arrs";
-            group = "media";
-            openFirewall = true;
-            dataDir = "/media";
-            package = delugePkg;
-            web = {
-              enable = true;
-              port = cfg.deluge.port;
-              openFirewall = true;
-            };
-          };
-
-          services.jackett = {
-            enable = cfg.jackett.enable;
-            user = "arrs";
-            group = "media";
-            openFirewall = true;
-            package = jackettPkg;
-          };
-
-          # Create required users and groups
-          users.users.arrs = {
-            isSystemUser = true;
-            uid = lib.mkForce arrUserId;
-            group = "media";
-            extraGroups = [ "downloads" ];
-          };
-
-          users.groups = {
-            media = {
-              gid = lib.mkForce arrGroupId;
-            };
-            downloads = { };
-          };
-
-          # System packages
-          environment.systemPackages = with pkgs; [
-            glib
-            sqlite
-            mono
-            mediainfo
-            protonvpn-cli_2
-          ];
-
-          # Create and set permissions for required directories
-          system.activationScripts.arr-dirs = ''
-            mkdir -p ${radarrDataDir}
-            mkdir -p ${sonarrDataDir}
-            mkdir -p ${sabnzbdConfig}
-            mkdir -p ${downloadDir}
-            mkdir -p ${incompleteDir}
-            mkdir -p ${mediaDir}
-
-            chown -R arrs:media ${radarrDataDir}
-            chown -R arrs:media ${sonarrDataDir}
-            chown -R arrs:media ${sabnzbdConfig}
-            chown -R arrs:media ${downloadDir}
-            chown -R arrs:media ${incompleteDir}
-            chown -R arrs:media ${mediaDir}
-
-            chmod -R 775 ${radarrDataDir}
-            chmod -R 775 ${sonarrDataDir}
-            chmod -R 775 ${sabnzbdConfig}
-            chmod -R 775 ${downloadDir}
-            chmod -R 775 ${incompleteDir}
-            chmod -R 775 ${mediaDir}
-
-          '';
-
-          networking = {
-            firewall = {
-              enable = true;
-              allowedTCPPorts = [
-                cfg.radarr.port
-                cfg.sonarr.port
-                cfg.sabnzbd.port
-                8080
-              ];
-            };
-            # Use systemd-resolved inside the container
-            # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-            useHostResolvConf = lib.mkForce false;
-          };
-
-          services.resolved.enable = true;
-          system.stateVersion = "23.11";
-        };
-
-      # Bind mount directories from host
-      bindMounts = {
-        "/etc/resolv.conf" = {
-          hostPath = "/etc/resolv.conf";
-          isReadOnly = true;
-        };
-        "${radarrDataDir}" = {
-          hostPath = cfg.radarr.dataDir;
-          isReadOnly = false;
-        };
-        "${sonarrDataDir}" = {
-          hostPath = cfg.sonarr.dataDir;
-          isReadOnly = false;
-        };
-        "${sabnzbdConfig}" = {
-          hostPath = cfg.sabnzbd.dataDir;
-          isReadOnly = false;
-        };
-        "${downloadDir}" = {
-          hostPath = cfg.downloadsDir;
-          isReadOnly = false;
-        };
-        "${incompleteDir}" = {
-          hostPath = cfg.incompleteDownloadsDir;
-          isReadOnly = false;
-        };
-        "${jackettDir}" = {
-          hostPath = cfg.jackett.dataDir;
-          isReadOnly = false;
-        };
-        "/media/movies" = {
-          hostPath = cfg.moviesDir;
-          isReadOnly = false;
-        };
-        "/media/tv" = {
-          hostPath = cfg.tvDir;
-          isReadOnly = false;
-        };
-        "/media/isos" = {
-          hostPath = cfg.isosDir;
-          isReadOnly = false;
-        };
-      };
-    };
-
-    networking = {
-      nat = {
-        forwardPorts = [
-          {
-            destination = "${cfg.localAddress}:${toString cfg.radarr.port}";
-            sourcePort = cfg.radarr.port;
-          }
-          {
-            destination = "${cfg.localAddress}:${toString cfg.sonarr.port}";
-            sourcePort = cfg.sonarr.port;
-          }
-          {
-            destination = "${cfg.localAddress}:8080";
-            sourcePort = cfg.sabnzbd.port;
-          }
-          {
-            destination = "${cfg.localAddress}:${toString cfg.deluge.port}";
-            sourcePort = cfg.deluge.port;
-          }
-          {
-            destination = "${cfg.localAddress}:${toString cfg.jackett.port}";
-            sourcePort = cfg.jackett.port;
-          }
-        ];
-      };
-      firewall = {
-        allowedTCPPorts = [
-          cfg.radarr.port
-          cfg.sonarr.port
-          cfg.sabnzbd.port
-          8080
-          cfg.deluge.port
-          cfg.jackett.port
-        ];
-        allowedUDPPorts = [
-          cfg.radarr.port
-          cfg.sonarr.port
-          cfg.sabnzbd.port
-          8080
-          cfg.deluge.port
-          cfg.jackett.port
-        ];
-      };
-    };
-  };
-}

modules/nixos/services/arrs/options.nix

@@ -1,112 +0,0 @@
-{ lib, namespace, ... }:
-with lib;
-{
-  options.${namespace}.services.arrs = {
-    enable = mkEnableOption "arrs services";
-
-    radarr = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      port = mkOption {
-        type = types.int;
-        default = 7878;
-      };
-      dataDir = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-
-    sonarr = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      port = mkOption {
-        type = types.int;
-        default = 8989;
-      };
-      dataDir = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-
-    sabnzbd = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      port = mkOption {
-        type = types.int;
-        default = 8280;
-      };
-      dataDir = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-
-    deluge = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      port = mkOption {
-        type = types.int;
-        default = 8112;
-      };
-      dataDir = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-
-    jackett = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      port = mkOption {
-        type = types.int;
-        default = 9117;
-      };
-      dataDir = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-
-    localAddress = mkOption {
-      type = types.str;
-      default = "127.0.0.1";
-    };
-
-    downloadsDir = mkOption {
-      type = types.str;
-      default = "";
-    };
-
-    incompleteDownloadsDir = mkOption {
-      type = types.str;
-      default = "";
-    };
-
-    moviesDir = mkOption {
-      type = types.str;
-      default = "";
-    };
-
-    tvDir = mkOption {
-      type = types.str;
-      default = "";
-    };
-
-    isosDir = mkOption {
-      type = types.str;
-      default = "";
-    };
-  };
-}

modules/nixos/services/attic/default.nix

@@ -7,12 +7,14 @@
 }:
 with lib;
 let
-  cfg = config.${namespace}.services.attic;
+  name = "attic";
-in
+  cfg = config.${namespace}.services.${name};
-{
-  imports = [ ./options.nix ];
 
-  config = mkIf cfg.enable {
+  atticConfig = lib.${namespace}.mkModule {
+    inherit config name;
+    description = "attic Service";
+    options = { };
+    moduleConfig = {
       services.atticd = {
         enable = true;
         environmentFile = cfg.environmentFile;
@@ -21,12 +23,6 @@ in
         };
       };
 
-    # Open firewall for attic if enabled
-    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
-      allowedUDPPorts = [ cfg.port ];
-    };
-
       # Include the attic watch-store service and rebuild cache services
       systemd.services = {
         attic-watch-store = {
@@ -155,4 +151,8 @@ in
         ];
       };
     };
+  };
+in
+{
+  imports = [ atticConfig ];
 }

modules/nixos/services/attic/options.nix

@@ -1,31 +0,0 @@
-{ lib, namespace, ... }:
-with lib;
-{
-  options.${namespace}.services.attic = {
-    enable = mkEnableOption "attic binary cache daemon";
-
-    port = mkOption {
-      type = types.port;
-      default = 9012;
-      description = "Port for attic cache daemon";
-    };
-
-    openFirewall = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Whether to open firewall for attic";
-    };
-
-    environmentFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = "Path to environment file containing attic secrets";
-    };
-
-    listenAddress = mkOption {
-      type = types.str;
-      default = "[::1]";
-      description = "Address to listen on";
-    };
-  };
-}