feat(media): embed recyclarr config with codec scoring, enable qbittorrent auto-tmm

Add systemd oneshot + daily timer to sync TRaSH Guides quality profiles
and custom formats to Radarr/Sonarr via recyclarr.

configuration.nix

@@ -32,6 +32,13 @@
     ./services/jellyfin-qbittorrent-monitor.nix
     ./services/bitmagnet.nix
 
+    ./services/prowlarr.nix
+    ./services/sonarr.nix
+    ./services/radarr.nix
+    ./services/bazarr.nix
+    ./services/jellyseerr.nix
+    ./services/recyclarr.nix
+
     ./services/soulseek.nix
 
     ./services/ups.nix
@@ -192,6 +199,7 @@
     hostName = hostname;
     hostId = "0f712d56";
     firewall.enable = true;
+    firewall.trustedInterfaces = [ "wg-br" ];
     useDHCP = false;
     enableIPv6 = false;
 

flake.nix

@@ -125,6 +125,11 @@
           ntfy = 2586;
           livekit = 7880;
           lk_jwt = 8081;
+          prowlarr = 9696;
+          sonarr = 8989;
+          radarr = 7878;
+          bazarr = 6767;
+          jellyseerr = 5055;
         };
 
         https = {
@@ -193,6 +198,35 @@
           signalBackupDir = "/${zpool_ssds}/bak/signal";
           grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";
         };
+
+        sonarr = {
+          dataDir = services_dir + "/sonarr";
+        };
+
+        radarr = {
+          dataDir = services_dir + "/radarr";
+        };
+
+        prowlarr = {
+          dataDir = services_dir + "/prowlarr";
+        };
+
+        bazarr = {
+          dataDir = services_dir + "/bazarr";
+        };
+
+        jellyseerr = {
+          configDir = services_dir + "/jellyseerr";
+        };
+
+        recyclarr = {
+          dataDir = services_dir + "/recyclarr";
+        };
+
+        media = {
+          moviesDir = torrents_path + "/media/movies";
+          tvDir = torrents_path + "/media/tv";
+        };
       };
 
       pkgs = import nixpkgs {

services/bazarr.nix

@@ -0,0 +1,34 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "bazarr" service_configs.zpool_ssds [
+      service_configs.bazarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "bazarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "bazarr" [
+      "Z ${service_configs.bazarr.dataDir} 0700 ${config.services.bazarr.user} ${config.services.bazarr.group}"
+    ])
+  ];
+
+  services.bazarr = {
+    enable = true;
+    listenPort = service_configs.ports.bazarr;
+  };
+
+  services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.bazarr}
+  '';
+
+  users.users.${config.services.bazarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}

services/jellyseerr.nix

@@ -0,0 +1,43 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "jellyseerr" service_configs.zpool_ssds [
+      service_configs.jellyseerr.configDir
+    ])
+    (lib.serviceFilePerms "jellyseerr" [
+      "Z ${service_configs.jellyseerr.configDir} 0700 jellyseerr jellyseerr"
+    ])
+  ];
+
+  services.jellyseerr = {
+    enable = true;
+    port = service_configs.ports.jellyseerr;
+    configDir = service_configs.jellyseerr.configDir;
+  };
+
+  systemd.services.jellyseerr.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "jellyseerr";
+    Group = "jellyseerr";
+    ReadWritePaths = [ service_configs.jellyseerr.configDir ];
+  };
+
+  users.users.jellyseerr = {
+    isSystemUser = true;
+    group = "jellyseerr";
+    home = service_configs.jellyseerr.configDir;
+  };
+
+  users.groups.jellyseerr = { };
+
+  services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = ''
+    # import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.jellyseerr}
+  '';
+}

services/prowlarr.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [
+      service_configs.prowlarr.dataDir
+    ])
+    (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
+  ];
+
+  services.prowlarr = {
+    enable = true;
+    dataDir = service_configs.prowlarr.dataDir;
+    settings.server.port = service_configs.ports.prowlarr;
+  };
+
+  services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}
+  '';
+}

services/qbittorrent.nix

@@ -86,6 +86,11 @@
         # how many connections per sec
         ConnectionSpeed = 300;
 
+        # Automatic Torrent Management: use category save paths for new torrents
+        DisableAutoTMMByDefault = false;
+        DisableAutoTMMTriggers.CategorySavePathChanged = false;
+        DisableAutoTMMTriggers.DefaultSavePathChanged = false;
+
         ChokingAlgorithm = "RateBased";
         PieceExtentAffinity = true;
         SuggestMode = true;

services/radarr.nix

@@ -0,0 +1,36 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "radarr" service_configs.zpool_ssds [
+      service_configs.radarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "radarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "radarr" [
+      "Z ${service_configs.radarr.dataDir} 0700 ${config.services.radarr.user} ${config.services.radarr.group}"
+    ])
+  ];
+
+  services.radarr = {
+    enable = true;
+    dataDir = service_configs.radarr.dataDir;
+    settings.server.port = service_configs.ports.radarr;
+    settings.update.mechanism = "external";
+  };
+
+  services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.radarr}
+  '';
+
+  users.users.${config.services.radarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}

services/recyclarr.nix

@@ -0,0 +1,165 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  radarrPort = builtins.toString service_configs.ports.radarr;
+  sonarrPort = builtins.toString service_configs.ports.sonarr;
+
+  configTemplate = pkgs.writeText "recyclarr.yml" ''
+    radarr:
+      movies:
+        base_url: http://localhost:${radarrPort}
+        api_key: RADARR_API_KEY_PLACEHOLDER
+
+        include:
+          - template: radarr-quality-definition-movie
+          - template: radarr-quality-profile-remux-web-2160p
+          - template: radarr-custom-formats-remux-web-2160p
+
+        # Override template to also allow 1080p (2160p still prioritized via cutoff)
+        quality_profiles:
+          - name: Remux + WEB 2160p
+            upgrade:
+              allowed: true
+              until_quality: Remux-2160p
+            qualities:
+              - name: Remux-2160p
+              - name: WEB 2160p
+                qualities:
+                  - WEBDL-2160p
+                  - WEBRip-2160p
+              - name: Remux-1080p
+              - name: Bluray-1080p
+              - name: WEB 1080p
+                qualities:
+                  - WEBDL-1080p
+                  - WEBRip-1080p
+              - name: HDTV-1080p
+
+        custom_formats:
+          - trash_ids:
+              - bfd8eb01832d646a0a89c4deb46f8564  # Upscaled
+            assign_scores_to:
+              - name: Remux + WEB 2160p
+                score: -10000
+          # Codec preferences: allow x265/HEVC (override template -10000 penalties)
+          - trash_ids:
+              - dc98083864ea246d05a42df0d05f81cc  # x265 (HD)
+            assign_scores_to:
+              - name: Remux + WEB 2160p
+                score: 0
+          - trash_ids:
+              - 839bea857ed2c0a8e084f3cbdbd65ecb  # x265 (no HDR/DV)
+            assign_scores_to:
+              - name: Remux + WEB 2160p
+                score: 0
+          - trash_ids:
+              - cae4ca30163749b891686f95532519bd  # AV1
+            assign_scores_to:
+              - name: Remux + WEB 2160p
+                score: 0
+
+    sonarr:
+      series:
+        base_url: http://localhost:${sonarrPort}
+        api_key: SONARR_API_KEY_PLACEHOLDER
+
+        include:
+          - template: sonarr-quality-definition-series
+          - template: sonarr-v4-quality-profile-web-2160p
+          - template: sonarr-v4-custom-formats-web-2160p
+
+        # Override template to also allow 1080p (2160p still prioritized via cutoff)
+        quality_profiles:
+          - name: WEB-2160p
+            upgrade:
+              allowed: true
+              until_quality: WEB 2160p
+            qualities:
+              - name: WEB 2160p
+                qualities:
+                  - WEBDL-2160p
+                  - WEBRip-2160p
+              - name: Bluray-1080p Remux
+              - name: Bluray-1080p
+              - name: WEB 1080p
+                qualities:
+                  - WEBDL-1080p
+                  - WEBRip-1080p
+              - name: HDTV-1080p
+
+        custom_formats:
+          - trash_ids:
+              - 23297a736ca77c0fc8e70f8edd7ee56c  # Upscaled
+            assign_scores_to:
+              - name: WEB-2160p
+                score: -10000
+          # Codec preferences: allow x265/HEVC (override template -10000 penalties)
+          - trash_ids:
+              - 47435ece6b99a0b477caf360e79ba0bb  # x265 (HD)
+            assign_scores_to:
+              - name: WEB-2160p
+                score: 0
+          - trash_ids:
+              - 9b64dff695c2115facf1b6ea59c9bd07  # x265 (no HDR/DV)
+            assign_scores_to:
+              - name: WEB-2160p
+                score: 0
+          - trash_ids:
+              - 15a05bc7c1a36e2b57fd628f8977e2fc  # AV1
+            assign_scores_to:
+              - name: WEB-2160p
+                score: 0
+  '';
+
+  dataDir = service_configs.recyclarr.dataDir;
+  radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
+  sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
+
+  # Script to inject API keys from sonarr/radarr config.xml at runtime
+  generateConfig = pkgs.writeShellScript "recyclarr-generate-config" ''
+    RADARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
+    SONARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    ${pkgs.gnused}/bin/sed \
+      -e "s/RADARR_API_KEY_PLACEHOLDER/$RADARR_KEY/" \
+      -e "s/SONARR_API_KEY_PLACEHOLDER/$SONARR_KEY/" \
+      ${configTemplate} > ${dataDir}/recyclarr.yml
+  '';
+in
+{
+  imports = [
+    (lib.serviceMountWithZpool "recyclarr" service_configs.zpool_ssds [
+      dataDir
+    ])
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 root root -"
+    "d ${dataDir}/data 0755 root root -"
+  ];
+
+  systemd.services.recyclarr = {
+    description = "Recyclarr TRaSH Guides Sync";
+    after = [ "network-online.target" "radarr.service" "sonarr.service" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStartPre = "${generateConfig}";
+      ExecStart = "${pkgs.recyclarr}/bin/recyclarr sync --config ${dataDir}/recyclarr.yml --app-data ${dataDir}/data";
+    };
+  };
+
+  systemd.timers.recyclarr = {
+    description = "Run Recyclarr daily";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "1h";
+    };
+  };
+}

services/sonarr.nix

@@ -0,0 +1,42 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "sonarr" service_configs.zpool_ssds [
+      service_configs.sonarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "sonarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "sonarr" [
+      "Z ${service_configs.sonarr.dataDir} 0700 ${config.services.sonarr.user} ${config.services.sonarr.group}"
+    ])
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d /torrents/media 2775 root ${service_configs.media_group} -"
+    "d ${service_configs.media.tvDir} 2775 root ${service_configs.media_group} -"
+    "d ${service_configs.media.moviesDir} 2775 root ${service_configs.media_group} -"
+  ];
+
+  services.sonarr = {
+    enable = true;
+    dataDir = service_configs.sonarr.dataDir;
+    settings.server.port = service_configs.ports.sonarr;
+    settings.update.mechanism = "external";
+  };
+
+  services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.sonarr}
+  '';
+
+  users.users.${config.services.sonarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}