feat: initial setup media
This commit is contained in:
parent
cc3a71d755
commit
636a19debb
2 changed files with 330 additions and 4 deletions
|
|
@ -1,17 +1,19 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
# Edit this configuration file to define what should be installed on your system. Help is available in the configuration.nix(5) man page, on
|
||||||
# your system. Help is available in the configuration.nix(5) man page, on
|
|
||||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||||
{
|
{
|
||||||
|
inputs,
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
serverIP = "192.168.0.201";
|
serverIP = "192.168.0.201";
|
||||||
|
pkgs-unstable = inputs.nixpkgs.legacyPackages.${pkgs.system};
|
||||||
in {
|
in {
|
||||||
imports = [
|
imports = [
|
||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
../../modules/nixos/qbittorrent.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
# Use the systemd-boot EFI boot loader.
|
# Use the systemd-boot EFI boot loader.
|
||||||
|
|
@ -22,6 +24,7 @@ in {
|
||||||
# Pick only one of the below networking options.
|
# Pick only one of the below networking options.
|
||||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
|
||||||
# Set your time zone.
|
# Set your time zone.
|
||||||
time.timeZone = "Europe/Vienna";
|
time.timeZone = "Europe/Vienna";
|
||||||
|
|
@ -71,8 +74,8 @@ in {
|
||||||
ports = [
|
ports = [
|
||||||
"${serverIP}:53:53/tcp"
|
"${serverIP}:53:53/tcp"
|
||||||
"${serverIP}:53:53/udp"
|
"${serverIP}:53:53/udp"
|
||||||
"80:80"
|
"12345:80"
|
||||||
"443:443"
|
"23456:443"
|
||||||
];
|
];
|
||||||
volumes = [
|
volumes = [
|
||||||
"/var/lib/pihole/:/etc/pihole/"
|
"/var/lib/pihole/:/etc/pihole/"
|
||||||
|
|
@ -90,5 +93,102 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.radarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/media/radarr";
|
||||||
|
group = "media";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.sonarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/media/radarr";
|
||||||
|
group = "media";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.readarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/media/radarr";
|
||||||
|
group = "media";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.qbittorrent = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
group = "media";
|
||||||
|
profileDir = "/media/qbittorrent";
|
||||||
|
|
||||||
|
serverConfig = {
|
||||||
|
LegalNotice.Accepted = true;
|
||||||
|
Preferences = {
|
||||||
|
WebUI = {
|
||||||
|
Username = "Spr3eZ";
|
||||||
|
Password_PBKDF2 = "@ByteArray(rSRSjyLjKHX4KeDHgtx8qA==:EdZC27+FdG0aFtqVtEsiuqQAA6NROdBRXVSySD6ktgBY7k9ORrq8Kgo2uIkXvAWssmMIFb+C3RZS2PMWAt/Ihw==)";
|
||||||
|
};
|
||||||
|
General.Locale = "en";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.jackett = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/media/jackett";
|
||||||
|
package = pkgs-unstable.jackett;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.jellyfin = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
group = "media";
|
||||||
|
dataDir = "/media/jellyfin";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.jellyseerr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.jellyseerr-restarter = {
|
||||||
|
enable = true;
|
||||||
|
description = "Restarts Jellyseerr on startup as that fixes it not loading anything and not recognizing anything for whatever reason.";
|
||||||
|
wantedBy = ["default.target"];
|
||||||
|
after = ["jellyseerr.service"];
|
||||||
|
script = ''
|
||||||
|
sleep 10
|
||||||
|
systemctl restart jellyseerr.service
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.caddy = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts."jackett.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :9117
|
||||||
|
'';
|
||||||
|
virtualHosts."qbittorrent.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :8080
|
||||||
|
'';
|
||||||
|
virtualHosts."radarr.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :7878
|
||||||
|
'';
|
||||||
|
virtualHosts."sonarr.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :8989
|
||||||
|
'';
|
||||||
|
virtualHosts."readarr.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :8787
|
||||||
|
'';
|
||||||
|
virtualHosts."jellyfin.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :8787
|
||||||
|
'';
|
||||||
|
virtualHosts."jellyseer.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :8787
|
||||||
|
'';
|
||||||
|
virtualHosts."pihole.saberofxebec".extraConfig = ''
|
||||||
|
reverse_proxy :12345
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
system.stateVersion = "24.11"; # Did you read the comment?
|
system.stateVersion = "24.11"; # Did you read the comment?
|
||||||
}
|
}
|
||||||
|
|
|
||||||
226
modules/nixos/qbittorrent.nix
Normal file
226
modules/nixos/qbittorrent.nix
Normal file
|
|
@ -0,0 +1,226 @@
|
||||||
|
# NOTE:
|
||||||
|
# This file is 1:1 stolen from the latest update of this nixpkgs pull request:
|
||||||
|
# https://github.com/NixOS/nixpkgs/pull/287923
|
||||||
|
# If that at any point gets merged I would much rather just use that.
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
utils,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
cfg = config.services.qbittorrent;
|
||||||
|
inherit (builtins) concatStringsSep isAttrs isString;
|
||||||
|
inherit
|
||||||
|
(lib)
|
||||||
|
literalExpression
|
||||||
|
getExe
|
||||||
|
mkEnableOption
|
||||||
|
mkOption
|
||||||
|
mkPackageOption
|
||||||
|
mkIf
|
||||||
|
maintainers
|
||||||
|
escape
|
||||||
|
collect
|
||||||
|
mapAttrsRecursive
|
||||||
|
;
|
||||||
|
inherit
|
||||||
|
(lib.types)
|
||||||
|
str
|
||||||
|
port
|
||||||
|
path
|
||||||
|
nullOr
|
||||||
|
listOf
|
||||||
|
attrsOf
|
||||||
|
anything
|
||||||
|
submodule
|
||||||
|
;
|
||||||
|
inherit (lib.generators) toINI mkKeyValueDefault mkValueStringDefault;
|
||||||
|
gendeepINI = toINI {
|
||||||
|
mkKeyValue = let
|
||||||
|
sep = "=";
|
||||||
|
in
|
||||||
|
k: v:
|
||||||
|
if isAttrs v
|
||||||
|
then
|
||||||
|
concatStringsSep "\n" (
|
||||||
|
collect isString (
|
||||||
|
mapAttrsRecursive (
|
||||||
|
path: value: "${escape [sep] (concatStringsSep "\\" ([k] ++ path))}${sep}${mkValueStringDefault {} value}"
|
||||||
|
)
|
||||||
|
v
|
||||||
|
)
|
||||||
|
)
|
||||||
|
else mkKeyValueDefault {} sep k v;
|
||||||
|
};
|
||||||
|
configFile = pkgs.writeText "qBittorrent.conf" (gendeepINI cfg.serverConfig);
|
||||||
|
in {
|
||||||
|
options.services.qbittorrent = {
|
||||||
|
enable = mkEnableOption "qbittorrent, BitTorrent client";
|
||||||
|
|
||||||
|
package = mkPackageOption pkgs "qbittorrent-nox" {};
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
type = str;
|
||||||
|
default = "qbittorrent";
|
||||||
|
description = "User account under which qbittorrent runs.";
|
||||||
|
};
|
||||||
|
|
||||||
|
group = mkOption {
|
||||||
|
type = str;
|
||||||
|
default = "qbittorrent";
|
||||||
|
description = "Group under which qbittorrent runs.";
|
||||||
|
};
|
||||||
|
|
||||||
|
profileDir = mkOption {
|
||||||
|
type = path;
|
||||||
|
default = "/var/lib/qBittorrent/";
|
||||||
|
description = "the path passed to qbittorrent via --profile.";
|
||||||
|
};
|
||||||
|
|
||||||
|
openFirewall = mkEnableOption "opening both the webuiPort and torrentPort over TCP in the firewall";
|
||||||
|
|
||||||
|
webuiPort = mkOption {
|
||||||
|
default = 8080;
|
||||||
|
type = nullOr port;
|
||||||
|
description = "the port passed to qbittorrent via `--webui-port`";
|
||||||
|
};
|
||||||
|
|
||||||
|
torrentingPort = mkOption {
|
||||||
|
default = null;
|
||||||
|
type = nullOr port;
|
||||||
|
description = "the port passed to qbittorrent via `--torrenting-port`";
|
||||||
|
};
|
||||||
|
|
||||||
|
serverConfig = mkOption {
|
||||||
|
type = submodule {
|
||||||
|
freeformType = attrsOf (attrsOf anything);
|
||||||
|
options.Preferences.WebUI.UseUPnP = mkEnableOption "UPnP for access to the qbittorrent WebUI";
|
||||||
|
};
|
||||||
|
description = ''
|
||||||
|
Free-form settings mapped to the `qBittorrent.conf` file in the profile.
|
||||||
|
Refer to [Explanation-of-Options-in-qBittorrent](https://github.com/qbittorrent/qBittorrent/wiki/Explanation-of-Options-in-qBittorrent)
|
||||||
|
the Password_PBKDF2 format is oddly unique, you will likely want to use [this tool](https://codeberg.org/feathecutie/qbittorrent_password) to generate the format.
|
||||||
|
alternatively you can run qBittorrent independently first and use its webUI to generate the format.
|
||||||
|
'';
|
||||||
|
example = literalExpression ''
|
||||||
|
{
|
||||||
|
LegalNotice.Accepted = true;
|
||||||
|
Preferences = {
|
||||||
|
WebUI = {
|
||||||
|
Username = "user";
|
||||||
|
Password_PBKDF2 = "generated ByteArray.";
|
||||||
|
};
|
||||||
|
General.Locale = "en";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
extraArgs = mkOption {
|
||||||
|
type = listOf str;
|
||||||
|
default = [];
|
||||||
|
description = ''
|
||||||
|
Extra arguments passed to qbittorrent. See `qbittorrent -h`, or the [source code](https://github.com/qbittorrent/qBittorrent/blob/master/src/app/cmdoptions.cpp), for the available arguments.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"--confirm-legal-notice"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
systemd = {
|
||||||
|
tmpfiles.settings = {
|
||||||
|
qbittorrent = {
|
||||||
|
"${cfg.profileDir}/qBittorrent/"."d" = {
|
||||||
|
mode = "775";
|
||||||
|
inherit (cfg) user group;
|
||||||
|
};
|
||||||
|
"${cfg.profileDir}/qBittorrent/config/"."d" = {
|
||||||
|
mode = "700";
|
||||||
|
inherit (cfg) user group;
|
||||||
|
};
|
||||||
|
"${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"."L+" = lib.mkIf (cfg.serverConfig != null) {
|
||||||
|
mode = "1400";
|
||||||
|
inherit (cfg) user group;
|
||||||
|
argument = "${configFile}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.qbittorrent = {
|
||||||
|
description = "qbittorrent BitTorrent client";
|
||||||
|
wants = ["network-online.target"];
|
||||||
|
after = [
|
||||||
|
"local-fs.target"
|
||||||
|
"network-online.target"
|
||||||
|
"nss-lookup.target"
|
||||||
|
];
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
restartTriggers = lib.optional (cfg.serverConfig != null) configFile;
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
User = cfg.user;
|
||||||
|
Group = cfg.group;
|
||||||
|
ExecStart = utils.escapeSystemdExecArgs (
|
||||||
|
[
|
||||||
|
(getExe cfg.package)
|
||||||
|
"--profile=${cfg.profileDir}"
|
||||||
|
]
|
||||||
|
++ lib.optional (cfg.webuiPort != null) "--webui-port=${toString cfg.webuiPort}"
|
||||||
|
++ lib.optional (cfg.torrentingPort != null) "--torrenting-port=${toString cfg.torrentingPort}"
|
||||||
|
++ cfg.extraArgs
|
||||||
|
);
|
||||||
|
TimeoutStopSec = 1800;
|
||||||
|
|
||||||
|
# https://github.com/qbittorrent/qBittorrent/pull/6806#discussion_r121478661
|
||||||
|
PrivateTmp = false;
|
||||||
|
|
||||||
|
PrivateNetwork = false;
|
||||||
|
RemoveIPC = true;
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProtectHome = "yes";
|
||||||
|
ProtectProc = "invisible";
|
||||||
|
ProcSubset = "pid";
|
||||||
|
ProtectSystem = "full";
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
RestrictAddressFamilies = [
|
||||||
|
"AF_INET"
|
||||||
|
"AF_INET6"
|
||||||
|
"AF_NETLINK"
|
||||||
|
];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
CapabilityBoundingSet = "";
|
||||||
|
SystemCallFilter = ["@system-service"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users = {
|
||||||
|
users = mkIf (cfg.user == "qbittorrent") {
|
||||||
|
qbittorrent = {
|
||||||
|
inherit (cfg) group;
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
groups = mkIf (cfg.group == "qbittorrent") {qbittorrent = {};};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall (
|
||||||
|
lib.optional (cfg.webuiPort != null) cfg.webuiPort
|
||||||
|
++ lib.optional (cfg.torrentingPort != null) cfg.torrentingPort
|
||||||
|
);
|
||||||
|
};
|
||||||
|
meta.maintainers = with maintainers; [fsnkty];
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue