blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

file cleanup, conditional motd

Browse Source
This commit is contained in:
blake
2026-06-14 08:35:44 -05:00
parent fcb8961c69
commit 11d3fcd8ec
27 changed files with 407 additions and 409 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/homelab/mediastack/audiobookshelf/default.nix
+1 -7
View File
@@ -6,7 +6,6 @@
}: let
service = "audiobookshelf";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
@@ -76,16 +75,11 @@ in {
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["abs.${homelab.public_domain}"];
#serverAliases = ["abs.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
modules/homelab/mediastack/bazarr/default.nix
+23 -20
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "bazarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -55,7 +58,7 @@ in
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" ];
extraGroups = ["media"];
};
# enable the ${service} service
@@ -72,9 +75,6 @@ in
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -84,16 +84,19 @@ in
};
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/flaresolverr/default.nix
+12 -12
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "flaresolverr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -68,9 +71,6 @@ in
Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
modules/homelab/mediastack/jellyfin/default.nix
+20 -22
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "jellyfin";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -43,9 +44,8 @@ in
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -55,7 +55,7 @@ in
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" "video" "render" ];
extraGroups = ["media" "video" "render"];
};
# enable the ${service} service
@@ -72,14 +72,9 @@ in
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
#services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "media.${homelab.public_domain}" ];
#tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
serverAliases = ["media.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,16 +82,19 @@ in
};
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://media.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
homelab.glance.links.mediastack = [
{
title = service;
url = "https://media.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/prowlarr/default.nix
+25 -20
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "prowlarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -55,7 +58,7 @@ in
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" ];
extraGroups = ["media"];
};
# enable the ${service} service
@@ -74,9 +77,6 @@ in
Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -86,16 +86,21 @@ in
};
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
};
};
}
modules/homelab/mediastack/qbittorrent/default.nix
+29 -35
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "qbittorrent";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -16,11 +17,11 @@ in
default = 7103;
description = "set port for ${service} (default: ${toString cfg.port}";
};
# torrenting_port = lib.mkOption {
# type = lib.types.int;
# default = ;
# description = "set port for ${service} (default: ${toString cfg.port}";
# };
# torrenting_port = lib.mkOption {
# type = lib.types.int;
# default = ;
# description = "set port for ${service} (default: ${toString cfg.port}";
# };
url = lib.mkOption {
type = lib.types.str;
default = "qbit.${homelab.base_domain}";
@@ -48,16 +49,18 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# ensure media dirs existence
systemd.tmpfiles.rules = [
"d /holocron/media/downloads 2775 qbittorrent media -"
];
];
# declare ${service} user
users.users.${service} = {
@@ -74,10 +77,10 @@ in
enable = true;
openFirewall = true;
user = service;
group = lib.mkForce "media"; # override for permissions
group = lib.mkForce "media"; # override for permissions
profileDir = cfg.data_dir;
webuiPort = cfg.port;
# torrentingPort = cfg.torrenting_port;
# torrentingPort = cfg.torrenting_port;
};
# override umask to make permissions work out
@@ -102,18 +105,6 @@ in
iptables -A QBIT -j DROP
'';
# boilerplate for if you ever want to try to get this working again
# ------------------------------------------------------------------------------
# # add systemd service to VPN network namespace
# vpnConfinement = {
# enable = true;
# vpnNamespace = "wgmex";
# };
# ------------------------------------------------------------------------------
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -123,16 +114,19 @@ in
};
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/radarr/default.nix
+26 -22
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "radarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -38,17 +40,19 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# required
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -58,7 +62,7 @@ in
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" ];
extraGroups = ["media"];
};
# enable the ${service} service
@@ -76,13 +80,10 @@ in
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -92,16 +93,19 @@ in
};
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/sonarr/default.nix
+4 -6
View File
@@ -6,7 +6,6 @@
}: let
service = "sonarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
@@ -40,7 +39,10 @@ in {
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
@@ -79,12 +81,8 @@ in {
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
modules/homelab/mediastack/yacreader/default.nix
+29 -24
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }:
let
{
pkgs,
config,
lib,
...
}: let
service = "yacreader";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in
{
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -38,17 +39,19 @@ in
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
default =
if cfg.enable
then service
else null;
};
};
config = lib.mkIf cfg.enable {
# install the binary
environment.systemPackages = with pkgs; [ yacreader ];
environment.systemPackages = with pkgs; [yacreader];
# declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
@@ -58,15 +61,15 @@ in
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" ];
extraGroups = ["media"];
};
# enable the ${service} service
systemd.services.${service} = {
description = "${service} library server";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
wantedBy = ["multi-user.target"];
after = ["network.target"];
serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
@@ -81,7 +84,7 @@ in
};
# open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ];
networking.firewall.allowedTCPPorts = [cfg.port];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
@@ -92,18 +95,20 @@ in
'';
};
# add to glance local service
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader"; }];
# add to glance local service
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader";
}
];
# add to backups
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
${service} = {paths = [cfg.data_dir];};
};
};
}