forked from
lass.pds.lassul.us/superconfig
This repository has no description
10 kB
331 lines
1{ config, pkgs, ... }:
2{
3 users.users.download = {
4 isSystemUser = true;
5 uid = 1001;
6 group = "download";
7 };
8 users.groups.download.members = [ "transmission" ];
9 services.transmission = {
10 enable = true;
11 home = "/var/state/transmission";
12 group = "download";
13 downloadDirPermissions = "775";
14 settings = {
15 download-dir = "/var/download/transmission";
16 incomplete-dir-enabled = false;
17 rpc-bind-address = "::";
18 message-level = 1;
19 umask = 18;
20 rpc-whitelist-enabled = false;
21 rpc-host-whitelist-enabled = false;
22 };
23 };
24
25 security.acme.defaults.email = "spam@krebsco.de";
26 security.acme.acceptTerms = true;
27 security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
28 security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
29 security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
30 security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
31 security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL;
32 services.nginx = {
33 enable = true;
34 package = pkgs.nginx.override {
35 modules = with pkgs.nginxModules; [
36 fancyindex
37 ];
38 };
39 virtualHosts."yellow.r" = {
40 serverAliases = [ "flix.r" ];
41 default = true;
42 enableACME = true;
43 addSSL = true;
44 locations."/" = {
45 root = "/var/download";
46 extraConfig = ''
47 fancyindex on;
48 fancyindex_footer "/fancy.html";
49 include ${pkgs.nginx}/conf/mime.types;
50 include ${pkgs.writeText "extrMime" ''
51 types {
52 video/webm mkv;
53 }
54 ''};
55 create_full_put_path on;
56 '';
57 };
58 locations."/chatty" = {
59 proxyPass = "http://localhost:3000";
60 extraConfig = ''
61 rewrite /chatty/(.*) /$1 break;
62 proxy_set_header Host $host;
63 '';
64 };
65 locations."= /fancy.html".extraConfig = ''
66 alias ${pkgs.writeText "nginx_footer" ''
67 <div id="mydiv">
68 <!-- Include a header DIV with the same name as the draggable DIV, followed by "header" -->
69 <div id="mydivheader">Click here to move</div>
70 <iframe src="/chatty/index.html"></iframe>
71 </div>
72 <style>
73 #mydiv {
74 position: absolute;
75 z-index: 9;
76 background-color: #f1f1f1;
77 border: 1px solid #d3d3d3;
78 text-align: center;
79 }
80
81 #mydivheader {
82 padding: 10px;
83 cursor: move;
84 z-index: 10;
85 background-color: #2196F3;
86 color: #fff;
87 }
88 </style>
89 <script>
90 // Make the DIV element draggable:
91 dragElement(document.getElementById("mydiv"));
92
93 function dragElement(elmnt) {
94 var pos1 = 0, pos2 = 0, pos3 = 0, pos4 = 0;
95 if (document.getElementById(elmnt.id + "header")) {
96 // if present, the header is where you move the DIV from:
97 document.getElementById(elmnt.id + "header").onmousedown = dragMouseDown;
98 } else {
99 // otherwise, move the DIV from anywhere inside the DIV:
100 elmnt.onmousedown = dragMouseDown;
101 }
102
103 function dragMouseDown(e) {
104 e = e || window.event;
105 e.preventDefault();
106 // get the mouse cursor position at startup:
107 pos3 = e.clientX;
108 pos4 = e.clientY;
109 document.onmouseup = closeDragElement;
110 // call a function whenever the cursor moves:
111 document.onmousemove = elementDrag;
112 }
113
114 function elementDrag(e) {
115 e = e || window.event;
116 e.preventDefault();
117 // calculate the new cursor position:
118 pos1 = pos3 - e.clientX;
119 pos2 = pos4 - e.clientY;
120 pos3 = e.clientX;
121 pos4 = e.clientY;
122 // set the element's new position:
123 elmnt.style.top = (elmnt.offsetTop - pos2) + "px";
124 elmnt.style.left = (elmnt.offsetLeft - pos1) + "px";
125 }
126
127 function closeDragElement() {
128 // stop moving when mouse button is released:
129 document.onmouseup = null;
130 document.onmousemove = null;
131 }
132 }
133 </script>
134 ''};
135 '';
136 };
137 virtualHosts."jelly.r" = {
138 enableACME = true;
139 addSSL = true;
140 locations."/".extraConfig = ''
141 proxy_pass http://localhost:8096/;
142 proxy_set_header Accept-Encoding "";
143 '';
144 };
145 virtualHosts."transmission.r" = {
146 enableACME = true;
147 addSSL = true;
148 locations."/" = {
149 proxyWebsockets = true;
150 proxyPass = "http://128.0.0.1:9091";
151 };
152 };
153 virtualHosts."radar.r" = {
154 enableACME = true;
155 addSSL = true;
156 locations."/" = {
157 proxyWebsockets = true;
158 proxyPass = "http://localhost:7878";
159 };
160 };
161 virtualHosts."sonar.r" = {
162 enableACME = true;
163 addSSL = true;
164 locations."/" = {
165 proxyWebsockets = true;
166 proxyPass = "http://localhost:8989";
167 };
168 };
169 };
170
171 services.samba = {
172 enable = true;
173 enableNmbd = false;
174 extraConfig = ''
175 workgroup = WORKGROUP
176 server string = ${config.networking.hostName}
177 # only allow retiolum addresses
178 hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
179
180 # Use sendfile() for performance gain
181 use sendfile = true
182
183 # No NetBIOS is needed
184 disable netbios = true
185
186 # Only mangle non-valid NTFS names, don't care about DOS support
187 mangled names = illegal
188
189 # Performance optimizations
190 socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
191
192 # Disable all printing
193 load printers = false
194 disable spoolss = true
195 printcap name = /dev/null
196
197 map to guest = Bad User
198 max log size = 50
199 dns proxy = no
200 security = user
201
202 [global]
203 syslog only = yes
204 '';
205 shares.public = {
206 comment = "Warez";
207 path = "/var/download";
208 public = "yes";
209 "only guest" = "yes";
210 "create mask" = "0644";
211 "directory mask" = "2777";
212 writable = "no";
213 printable = "no";
214 };
215 };
216
217 systemd.services.bruellwuerfel =
218 let
219 bruellwuerfelSrc = pkgs.fetchFromGitHub {
220 owner = "krebs";
221 repo = "bruellwuerfel";
222 rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
223 sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
224 };
225 in {
226 wantedBy = [ "multi-user.target" ];
227 environment = {
228 IRC_CHANNEL = "#flix";
229 IRC_NICK = "bruelli";
230 IRC_SERVER = "irc.r";
231 IRC_HISTORY_FILE = "/tmp/bruelli.history";
232 };
233 serviceConfig = {
234 ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
235 };
236 };
237
238 krebs.iptables = {
239 enable = true;
240 tables.filter.INPUT.rules = [
241 { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
242 { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
243 { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
244 { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
245 { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
246 { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
247 { predicate = "-p tcp --dport 8920"; target = "ACCEPT"; } # jellyfin
248 { predicate = "-p udp --dport 1900"; target = "ACCEPT"; } # jellyfin
249 { predicate = "-p udp --dport 7359"; target = "ACCEPT"; } # jellyfin
250 { predicate = "-p tcp --dport 5055"; target = "ACCEPT"; } # jellyseerr
251 { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
252 { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
253 { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
254 { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
255
256 # smbd
257 { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
258 { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
259 { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
260 { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
261 { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
262 { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
263 { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
264 { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
265 { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
266 { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
267 { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
268 { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
269 { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
270 { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
271 ];
272 };
273
274 systemd.services.flix-index = {
275 wantedBy = [ "multi-user.target" ];
276 path = [
277 pkgs.coreutils
278 pkgs.findutils
279 pkgs.inotify-tools
280 ];
281 serviceConfig = {
282 Restart = "always";
283 ExecStart = pkgs.writers.writeDash "flix-index" ''
284 set -efu
285
286 DIR=/var/download
287 cd "$DIR"
288 while inotifywait -rq -e create -e move -e delete "$DIR"; do
289 find . -type f > "$DIR"/index.tmp
290 mv "$DIR"/index.tmp "$DIR"/index
291 done
292 '';
293 };
294 };
295
296 services.jellyfin = {
297 enable = true;
298 group = "download";
299 };
300
301 # request managment
302 services.jellyseerr = {
303 enable = true;
304 };
305
306 # movies
307 services.radarr = {
308 enable = true;
309 user = "download";
310 group = "download";
311 };
312
313 # shows
314 services.sonarr = {
315 enable = true;
316 user = "download";
317 group = "download";
318 };
319
320 # indexers
321 services.prowlarr = {
322 enable = true;
323 };
324
325 # subtitles
326 services.bazarr = {
327 enable = true;
328 user = "download";
329 group = "download";
330 };
331}