Simon Gardling
4e19e67356
- prowlarr: remove serviceFilePerms (DynamicUser has no static user) - sonarr/radarr: move media dir creation to system-level tmpfiles rules to avoid unsafe path transition from /torrents (qbittorrent:media) - jellyseerr: override DynamicUser=false, create static user/group, use serviceFilePerms for ZFS-backed configDir permissions Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
43 lines
1.2 KiB
Nix
43 lines
1.2 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
service_configs,
|
|
lib,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
(lib.serviceMountWithZpool "sonarr" service_configs.zpool_ssds [
|
|
service_configs.sonarr.dataDir
|
|
])
|
|
(lib.serviceMountWithZpool "sonarr" service_configs.zpool_hdds [
|
|
service_configs.torrents_path
|
|
])
|
|
(lib.serviceFilePerms "sonarr" [
|
|
"Z ${service_configs.sonarr.dataDir} 0700 ${config.services.sonarr.user} ${config.services.sonarr.group}"
|
|
])
|
|
];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /torrents/media 2775 root ${service_configs.media_group} -"
|
|
"d ${service_configs.media.tvDir} 2775 root ${service_configs.media_group} -"
|
|
"d ${service_configs.media.moviesDir} 2775 root ${service_configs.media_group} -"
|
|
];
|
|
|
|
services.sonarr = {
|
|
enable = true;
|
|
dataDir = service_configs.sonarr.dataDir;
|
|
settings.server.port = service_configs.ports.sonarr;
|
|
settings.update.mechanism = "external";
|
|
};
|
|
|
|
services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
|
|
import ${config.age.secrets.caddy_auth.path}
|
|
reverse_proxy :${builtins.toString service_configs.ports.sonarr}
|
|
'';
|
|
|
|
users.users.${config.services.sonarr.user}.extraGroups = [
|
|
service_configs.media_group
|
|
];
|
|
}
|