forked from
lass.pds.lassul.us/superconfig
This repository has no description
11 kB
349 lines
1{ config, pkgs, ... }:
2{
3 users.users.download = {
4 isSystemUser = true;
5 uid = 1001;
6 group = "download";
7 };
8 users.groups.download.members = [ "transmission" ];
9 services.transmission = {
10 enable = true;
11 home = "/var/state/transmission";
12 group = "download";
13 downloadDirPermissions = "775";
14 settings = {
15 download-dir = "/var/download/transmission";
16 incomplete-dir-enabled = false;
17 rpc-bind-address = "::";
18 message-level = 1;
19 umask = 18;
20 rpc-whitelist-enabled = false;
21 rpc-host-whitelist-enabled = false;
22 };
23 };
24 systemd.services.transmission-watcher = {
25 wantedBy = [ "multi-user.target" ];
26 startAt = "*:0/5";
27 path = [
28 pkgs.curl
29 pkgs.systemdMinimal
30 ];
31 script = ''
32 set -efu -o pipefail
33 if ! curl -SsfL http://transmission.r; then
34 systemctl restart transmission*
35 fi
36 '';
37 };
38
39 security.acme.defaults.email = "spam@krebsco.de";
40 security.acme.acceptTerms = true;
41 security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
42 security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
43 security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
44 security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
45 security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL;
46 services.nginx = {
47 enable = true;
48 package = pkgs.nginx.override {
49 modules = with pkgs.nginxModules; [
50 fancyindex
51 ];
52 };
53 virtualHosts."yellow.r" = {
54 serverAliases = [ "flix.r" ];
55 default = true;
56 enableACME = true;
57 addSSL = true;
58 locations."/" = {
59 root = "/var/download";
60 extraConfig = ''
61 fancyindex on;
62 fancyindex_footer "/fancy.html";
63 include ${pkgs.nginx}/conf/mime.types;
64 include ${pkgs.writeText "extrMime" ''
65 types {
66 video/webm mkv;
67 }
68 ''};
69 create_full_put_path on;
70 '';
71 };
72 locations."/chatty" = {
73 proxyPass = "http://localhost:3000";
74 extraConfig = ''
75 rewrite /chatty/(.*) /$1 break;
76 proxy_set_header Host $host;
77 '';
78 };
79 locations."= /fancy.html".extraConfig = ''
80 alias ${pkgs.writeText "nginx_footer" ''
81 <div id="mydiv">
82 <!-- Include a header DIV with the same name as the draggable DIV, followed by "header" -->
83 <div id="mydivheader">Click here to move</div>
84 <iframe src="/chatty/index.html"></iframe>
85 </div>
86 <style>
87 #mydiv {
88 position: absolute;
89 z-index: 9;
90 background-color: #f1f1f1;
91 border: 1px solid #d3d3d3;
92 text-align: center;
93 }
94
95 #mydivheader {
96 padding: 10px;
97 cursor: move;
98 z-index: 10;
99 background-color: #2196F3;
100 color: #fff;
101 }
102 </style>
103 <script>
104 // Make the DIV element draggable:
105 dragElement(document.getElementById("mydiv"));
106
107 function dragElement(elmnt) {
108 var pos1 = 0, pos2 = 0, pos3 = 0, pos4 = 0;
109 if (document.getElementById(elmnt.id + "header")) {
110 // if present, the header is where you move the DIV from:
111 document.getElementById(elmnt.id + "header").onmousedown = dragMouseDown;
112 } else {
113 // otherwise, move the DIV from anywhere inside the DIV:
114 elmnt.onmousedown = dragMouseDown;
115 }
116
117 function dragMouseDown(e) {
118 e = e || window.event;
119 e.preventDefault();
120 // get the mouse cursor position at startup:
121 pos3 = e.clientX;
122 pos4 = e.clientY;
123 document.onmouseup = closeDragElement;
124 // call a function whenever the cursor moves:
125 document.onmousemove = elementDrag;
126 }
127
128 function elementDrag(e) {
129 e = e || window.event;
130 e.preventDefault();
131 // calculate the new cursor position:
132 pos1 = pos3 - e.clientX;
133 pos2 = pos4 - e.clientY;
134 pos3 = e.clientX;
135 pos4 = e.clientY;
136 // set the element's new position:
137 elmnt.style.top = (elmnt.offsetTop - pos2) + "px";
138 elmnt.style.left = (elmnt.offsetLeft - pos1) + "px";
139 }
140
141 function closeDragElement() {
142 // stop moving when mouse button is released:
143 document.onmouseup = null;
144 document.onmousemove = null;
145 }
146 }
147 </script>
148 ''};
149 '';
150 };
151 virtualHosts."jelly.r" = {
152 enableACME = true;
153 addSSL = true;
154 locations."/".extraConfig = ''
155 proxy_pass http://localhost:8096/;
156 proxy_set_header Accept-Encoding "";
157 '';
158 };
159 virtualHosts."transmission.r" = {
160 enableACME = true;
161 addSSL = true;
162 locations."/" = {
163 proxyWebsockets = true;
164 proxyPass = "http://128.0.0.1:9091";
165 };
166 };
167 virtualHosts."radar.r" = {
168 enableACME = true;
169 addSSL = true;
170 locations."/" = {
171 proxyWebsockets = true;
172 proxyPass = "http://localhost:7878";
173 };
174 };
175 virtualHosts."sonar.r" = {
176 enableACME = true;
177 addSSL = true;
178 locations."/" = {
179 proxyWebsockets = true;
180 proxyPass = "http://localhost:8989";
181 # sonar.r now has forced authentication
182 extraConfig = ''
183 proxy_set_header Authorization "Basic a3JlYnM6YWlkc2JhbGxz";
184 '';
185 };
186 };
187 };
188
189 services.samba = {
190 enable = true;
191 enableNmbd = false;
192 extraConfig = ''
193 workgroup = WORKGROUP
194 server string = ${config.networking.hostName}
195 # only allow retiolum addresses
196 hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 fdcc:c5da:5295:c853:d499::/80
197
198 # Use sendfile() for performance gain
199 use sendfile = true
200
201 # No NetBIOS is needed
202 disable netbios = true
203
204 # Only mangle non-valid NTFS names, don't care about DOS support
205 mangled names = illegal
206
207 # Performance optimizations
208 socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
209
210 # Disable all printing
211 load printers = false
212 disable spoolss = true
213 printcap name = /dev/null
214
215 map to guest = Bad User
216 max log size = 50
217 dns proxy = no
218 security = user
219
220 [global]
221 syslog only = yes
222 '';
223 shares.public = {
224 comment = "Warez";
225 path = "/var/download";
226 public = "yes";
227 "only guest" = "yes";
228 "create mask" = "0644";
229 "directory mask" = "2777";
230 writable = "no";
231 printable = "no";
232 };
233 };
234
235 systemd.services.bruellwuerfel =
236 let
237 bruellwuerfelSrc = pkgs.fetchFromGitHub {
238 owner = "krebs";
239 repo = "bruellwuerfel";
240 rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
241 sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
242 };
243 in {
244 wantedBy = [ "multi-user.target" ];
245 after = [ "network-online.target" ];
246 environment = {
247 IRC_CHANNEL = "#flix";
248 IRC_NICK = "bruelli";
249 IRC_SERVER = "irc.r";
250 IRC_HISTORY_FILE = "/tmp/bruelli.history";
251 };
252 serviceConfig = {
253 ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
254 };
255 };
256
257 krebs.iptables = {
258 enable = true;
259 tables.filter.INPUT.rules = [
260 { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
261 { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
262 { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
263 { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
264 { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
265 { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
266 { predicate = "-p tcp --dport 8920"; target = "ACCEPT"; } # jellyfin
267 { predicate = "-p udp --dport 1900"; target = "ACCEPT"; } # jellyfin
268 { predicate = "-p udp --dport 7359"; target = "ACCEPT"; } # jellyfin
269 { predicate = "-p tcp --dport 5055"; target = "ACCEPT"; } # jellyseerr
270 { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
271 { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
272 { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
273 { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
274
275 # smbd
276 { predicate = "-p tcp --dport 445"; target = "ACCEPT"; }
277 { predicate = "-p tcp --dport 111"; target = "ACCEPT"; }
278 { predicate = "-p udp --dport 111"; target = "ACCEPT"; }
279 { predicate = "-p tcp --dport 2049"; target = "ACCEPT"; }
280 { predicate = "-p udp --dport 2049"; target = "ACCEPT"; }
281 { predicate = "-p tcp --dport 4000:4002"; target = "ACCEPT"; }
282 { predicate = "-p udp --dport 4000:4002"; target = "ACCEPT"; }
283 ];
284
285 tables.nat.PREROUTING.rules = [
286 # transmission rpc port
287 { predicate = "-i retiolum -p tcp --dport 9091"; target = "DNAT --to-destination fdb4:3310:947::2"; v4 = false; }
288 ];
289 tables.filter.FORWARD.policy = "ACCEPT"; # we need this so we can forward into the the transmission network namespace
290 };
291
292 systemd.services.flix-index = {
293 wantedBy = [ "multi-user.target" ];
294 path = [
295 pkgs.coreutils
296 pkgs.findutils
297 pkgs.inotify-tools
298 ];
299 serviceConfig = {
300 Restart = "always";
301 ExecStart = pkgs.writers.writeDash "flix-index" ''
302 set -efu
303
304 DIR=/var/download
305 cd "$DIR"
306 while inotifywait -rq -e create -e move -e delete "$DIR"; do
307 find . -type f > "$DIR"/index.tmp
308 mv "$DIR"/index.tmp "$DIR"/index
309 done
310 '';
311 };
312 };
313
314 services.jellyfin = {
315 enable = true;
316 group = "download";
317 };
318
319 # request managment
320 services.jellyseerr = {
321 enable = true;
322 };
323
324 # movies
325 services.radarr = {
326 enable = true;
327 user = "download";
328 group = "download";
329 };
330
331 # shows
332 services.sonarr = {
333 enable = true;
334 user = "download";
335 group = "download";
336 };
337
338 # indexers
339 services.prowlarr = {
340 enable = true;
341 };
342
343 # subtitles
344 services.bazarr = {
345 enable = true;
346 user = "download";
347 group = "download";
348 };
349}