This repository has no description
15 kB
480 lines
1{ config, pkgs, ... }:
2{
3 # sabnzbd hard-depends on cheetah3, whose PyPI dist is `ct3` while nixpkgs
4 # sets pname="cheetah3". pythonMetadataCheckPhase then looks up metadata for
5 # "cheetah3", finds only "ct3", and fails the build with PackageNotFoundError.
6 # Skip that spurious check until nixpkgs fixes the pname/dist mismatch.
7 nixpkgs.overlays = [
8 (_final: prev: {
9 pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
10 (_pyfinal: pyprev: {
11 cheetah3 = pyprev.cheetah3.overridePythonAttrs (_: {
12 dontCheckPythonMetadata = true;
13 });
14 })
15 ];
16 })
17 ];
18 users.users.download = {
19 isSystemUser = true;
20 uid = 1001;
21 group = "download";
22 };
23 users.groups.download.members = [
24 "transmission"
25 "sabnzbd"
26 ];
27 services.transmission = {
28 enable = true;
29 package = pkgs.transmission_4;
30 home = "/var/state/transmission";
31 group = "download";
32 downloadDirPermissions = "775";
33 settings = {
34 download-dir = "/var/download/transmission";
35 incomplete-dir-enabled = false;
36 rpc-bind-address = "::";
37 message-level = 1;
38 # 0o002: files 664 so sonarr/radarr (group download) can hardlink
39 # instead of copying (fs.protected_hardlinks needs owner or write)
40 umask = 2;
41 rpc-whitelist-enabled = false;
42 rpc-host-whitelist-enabled = false;
43 # stop seeding after reaching 5.0 ratio
44 ratio-limit = 5;
45 ratio-limit-enabled = true;
46 # limit concurrent seeding to reduce resource usage
47 seed-queue-enabled = true;
48 seed-queue-size = 20;
49 };
50 };
51
52 # garbage collection for old torrents
53 systemd.services.transmission-gc = {
54 description = "Remove old completed torrents from Transmission";
55 after = [ "transmission.service" ];
56 path = [
57 pkgs.transmission_4
58 pkgs.jq
59 pkgs.coreutils
60 pkgs.gawk
61 pkgs.gnugrep
62 pkgs.findutils
63 ];
64 script = ''
65 set -efu
66 # transmission lives in its own netns (t1 = 128.0.0.1/30), this unit runs
67 # outside it (t2 = 128.0.0.2), so localhost is *not* the daemon here.
68 TRANSMISSION_HOST="128.0.0.1:9091"
69 MAX_AGE_DAYS=30
70 MIN_RATIO=5.0
71
72 # get list of all torrents as JSON
73 torrents=$(transmission-remote "$TRANSMISSION_HOST" -l 2>/dev/null | tail -n +2 | head -n -1 || true)
74
75 if [ -z "$torrents" ]; then
76 echo "No torrents found"
77 exit 0
78 fi
79
80 # process each torrent
81 echo "$torrents" | while read -r line; do
82 id=$(echo "$line" | awk '{print $1}' | tr -d '*')
83 # skip if not a valid ID
84 [ -z "$id" ] || [ "$id" = "ID" ] && continue
85
86 # get torrent info
87 info=$(transmission-remote "$TRANSMISSION_HOST" -t "$id" -i 2>/dev/null || continue)
88
89 # extract ratio and completion status
90 ratio=$(echo "$info" | grep "Ratio:" | awk '{print $2}')
91 percent=$(echo "$info" | grep "Percent Done:" | awk '{print $3}' | tr -d '%')
92 state=$(echo "$info" | grep "State:" | cut -d: -f2- | xargs)
93
94 # skip if not 100% complete
95 [ "$percent" != "100" ] && continue
96
97 # check if ratio reached
98 ratio_reached=false
99 if [ -n "$ratio" ] && [ "$ratio" != "None" ]; then
100 if awk "BEGIN {exit !($ratio >= $MIN_RATIO)}"; then
101 ratio_reached=true
102 fi
103 fi
104
105 # check age via date added
106 date_added=$(echo "$info" | grep "Date added:" | cut -d: -f2- | xargs)
107 if [ -n "$date_added" ]; then
108 added_epoch=$(date -d "$date_added" +%s 2>/dev/null || echo 0)
109 now_epoch=$(date +%s)
110 age_days=$(( (now_epoch - added_epoch) / 86400 ))
111 else
112 age_days=0
113 fi
114
115 # remove if ratio reached OR older than max age
116 if [ "$ratio_reached" = "true" ]; then
117 echo "Removing torrent $id (ratio: $ratio >= $MIN_RATIO)"
118 transmission-remote "$TRANSMISSION_HOST" -t "$id" --remove-and-delete
119 elif [ "$age_days" -ge "$MAX_AGE_DAYS" ]; then
120 echo "Removing torrent $id (age: $age_days days >= $MAX_AGE_DAYS)"
121 transmission-remote "$TRANSMISSION_HOST" -t "$id" --remove-and-delete
122 fi
123 done
124 '';
125 serviceConfig = {
126 Type = "oneshot";
127 User = "transmission";
128 };
129 };
130
131 systemd.timers.transmission-gc = {
132 wantedBy = [ "timers.target" ];
133 timerConfig = {
134 OnCalendar = "daily";
135 Persistent = true;
136 RandomizedDelaySec = "1h";
137 };
138 };
139 systemd.services.transmission-watcher = {
140 wantedBy = [ "multi-user.target" ];
141 startAt = "*:0/5";
142 path = [
143 pkgs.curl
144 pkgs.systemdMinimal
145 ];
146 script = ''
147 set -efu -o pipefail
148 # don't restart if transmission is currently starting or stopping
149 state=$(systemctl show -p ActiveState --value transmission.service)
150 if [ "$state" = "activating" ] || [ "$state" = "deactivating" ]; then
151 echo "transmission is $state, skipping"
152 exit 0
153 fi
154 # check if transmission responds (with timeout)
155 if ! curl -SsfL --max-time 10 http://transmission.r; then
156 echo "transmission not responding, restarting"
157 systemctl restart transmission.service
158 fi
159 '';
160 };
161
162 # pause downloads when /var/download runs low, so a full disk can no longer
163 # hard-wedge sabnzbd with an unrecoverable "Disk full! Forcing Pause".
164 # sabnzbd pauses itself once free disk drops below download_free/complete_free
165 # and only auto-resumes above if fulldisk_autoresume is set (default off);
166 # this guard keeps those at THRESH GiB / on, and additionally sends a resume
167 # on recovery. Transmission has no equivalent, so below the threshold the
168 # guard stops all its torrents (restarting them on recovery) and posts a
169 # Matrix alert on each transition.
170 systemd.services.download-space-guard = {
171 wantedBy = [ "multi-user.target" ];
172 after = [ "sabnzbd.service" ];
173 startAt = "*:0/5";
174 path = [
175 pkgs.curl
176 pkgs.coreutils
177 pkgs.gnugrep
178 pkgs.gawk
179 pkgs.jq
180 pkgs.transmission_4
181 ];
182 script = ''
183 set -efu
184 DIR=/var/download
185 THRESH=100
186 # !MRjkvAaFPsjdYCpeiZ:lassul.us, URL-encoded for the API path
187 ROOM=%21MRjkvAaFPsjdYCpeiZ%3Alassul.us
188 STATE="$STATE_DIRECTORY/state"
189
190 avail=$(df -Pk "$DIR" | awk 'NR==2 {print int($4 / 1024 / 1024)}')
191
192 INI=/var/lib/sabnzbd/sabnzbd.ini
193 key=$(grep -E '^api_key' "$INI" | head -1 | cut -d= -f2 | tr -d ' ')
194 sab() {
195 curl -fsS --max-time 15 "http://127.0.0.1:8080/api?output=json&apikey=$key&$1" >/dev/null || :
196 }
197 tr_remote() {
198 transmission-remote 128.0.0.1:9091 "$@" >/dev/null || :
199 }
200 notify() {
201 token=$(cat "$CREDENTIALS_DIRECTORY/matrix-token")
202 body=$(jq -nc --arg b "$1" '{msgtype: "m.text", body: $b}')
203 curl -fsS --max-time 15 -X POST \
204 -H "Authorization: Bearer $token" -H 'Content-Type: application/json' \
205 "https://matrix.lassul.us/_matrix/client/v3/rooms/$ROOM/send/m.room.message" \
206 --data "$body" >/dev/null || :
207 }
208
209 # sabnzbd pauses continuously once free disk drops below these; keep
210 # them at THRESH GiB and auto-resume on; re-assert only if changed.
211 for k in download_free complete_free; do
212 grep -qxF "$k = ''${THRESH}G" "$INI" \
213 || sab "mode=set_config§ion=misc&keyword=$k&value=''${THRESH}G"
214 done
215 grep -qxF "fulldisk_autoresume = 1" "$INI" \
216 || sab "mode=set_config§ion=misc&keyword=fulldisk_autoresume&value=1"
217
218 prev=ok
219 if [ -f "$STATE" ]; then prev=$(cat "$STATE"); fi
220 if [ "$avail" -lt "$THRESH" ]; then cur=low; else cur=ok; fi
221
222 if [ "$cur" = low ]; then
223 # stop everything each run so newly-grabbed torrents can't fill the disk
224 tr_remote -t all --stop
225 if [ "$prev" != low ]; then
226 echo "free ''${avail}G < ''${THRESH}G: stopped transmission, alerting"
227 notify "⚠️ yellow: /var/download down to ''${avail} GiB free (< ''${THRESH} GiB). Stopped all transmission torrents; sabnzbd auto-paused via download_free."
228 fi
229 elif [ "$prev" = low ]; then
230 echo "free ''${avail}G >= ''${THRESH}G: resumed transmission and sabnzbd, alerting"
231 tr_remote -t all --start
232 sab "mode=resume"
233 notify "✅ yellow: /var/download recovered to ''${avail} GiB free. Resumed sabnzbd and transmission torrents."
234 fi
235 echo "$cur" > "$STATE"
236 '';
237 serviceConfig = {
238 Type = "oneshot";
239 User = "root";
240 StateDirectory = "download-space-guard";
241 LoadCredential = [
242 "matrix-token:${config.clan.core.vars.generators.archiver-matrix.files."matrix-access-token".path}"
243 ];
244 };
245 };
246
247 security.acme.defaults.email = "spam@krebsco.de";
248 security.acme.acceptTerms = true;
249 security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
250 security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
251 security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
252 security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL;
253 services.nginx = {
254 enable = true;
255 package = pkgs.nginx.override {
256 modules = with pkgs.nginxModules; [
257 fancyindex
258 ];
259 };
260 virtualHosts."yellow.r" = {
261 serverAliases = [ "flix.r" ];
262 default = true;
263 enableACME = true;
264 addSSL = true;
265 locations."/" = {
266 root = "/var/download";
267 extraConfig = ''
268 fancyindex on;
269 include ${pkgs.nginx}/conf/mime.types;
270 include ${pkgs.writeText "extrMime" ''
271 types {
272 video/webm mkv;
273 }
274 ''};
275 create_full_put_path on;
276 '';
277 };
278
279 };
280 virtualHosts."jelly.r" = {
281 locations."/".extraConfig = ''
282 proxy_pass http://localhost:8096/;
283 proxy_set_header Accept-Encoding "";
284 '';
285 };
286 virtualHosts."transmission.r" = {
287 enableACME = true;
288 addSSL = true;
289 locations."/" = {
290 proxyWebsockets = true;
291 proxyPass = "http://128.0.0.1:9091";
292 };
293 };
294 virtualHosts."radar.r" = {
295 enableACME = true;
296 addSSL = true;
297 locations."/" = {
298 proxyWebsockets = true;
299 proxyPass = "http://localhost:7878";
300 };
301 };
302 virtualHosts."sonar.r" = {
303 enableACME = true;
304 addSSL = true;
305 locations."/" = {
306 proxyWebsockets = true;
307 proxyPass = "http://localhost:8989";
308 # sonar.r now has forced authentication
309 extraConfig = ''
310 proxy_set_header Authorization "Basic a3JlYnM6YWlkc2JhbGxz";
311 '';
312 };
313 };
314 };
315
316 services.samba = {
317 enable = true;
318 enableNmbd = false;
319 settings.global = {
320 "hosts allow" = "42::/16 10.243.0.0/16 10.244.0.0/16 fdcc:c5da:5295:c853:d499::/80";
321 "use sendfile" = "true";
322 "disable netbios" = "true";
323 "mangled names" = "illegal";
324 "socket options" = "TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536";
325 "load printers" = "false";
326 "disable spoolss" = "true";
327 "printcap name" = "/dev/null";
328 "map to guest" = "Bad User";
329 "max log size" = "50";
330 "dns proxy" = "no";
331 "security" = "user";
332 "syslog only" = "yes";
333 };
334 shares.public = {
335 comment = "Warez";
336 path = "/var/download";
337 public = "yes";
338 "only guest" = "yes";
339 "create mask" = "0644";
340 "directory mask" = "2777";
341 writable = "no";
342 printable = "no";
343 };
344 };
345
346 networking.firewall.allowedTCPPorts = [
347 80 # nginx
348 443 # nginx
349 9091 # transmission web
350 8096 # jellyfin
351 8920 # jellyfin
352 51413 # transmission traffic
353 445 # smbd
354 111 # smbd
355 2049 # smbd
356 4000 # smbd
357 4001 # smbd
358 4002 # smbd
359 ];
360 networking.firewall.allowedUDPPorts = [
361 51413 # transmission traffic
362 1900 # jellyfin
363 7359 # jellyfin
364 111 # smbd
365 2049 # smbd
366 4000 # smbd
367 4001 # smbd
368 4002 # smbd
369 ];
370 krebs.iptables = {
371 enable = true;
372 tables.nat.PREROUTING.rules = [
373 # transmission rpc port
374 {
375 predicate = "-i retiolum -p tcp --dport 9091";
376 target = "DNAT --to-destination fdb4:3310:947::2";
377 v4 = false;
378 }
379 ];
380 tables.filter.FORWARD.policy = "ACCEPT"; # we need this so we can forward into the the transmission network namespace
381 };
382
383 systemd.services.flix-index = {
384 wantedBy = [ "multi-user.target" ];
385 path = [
386 pkgs.coreutils
387 pkgs.findutils
388 pkgs.inotify-tools
389 ];
390 startAt = "hourly";
391 serviceConfig = {
392 Type = "oneshot";
393 ExecStart = pkgs.writers.writeDash "flix-index" ''
394 set -efu
395 index(){
396 # /var/download churns constantly (download temp files appearing and
397 # vanishing), so find can exit non-zero when an entry disappears
398 # mid-scan. Ignore that — the entries we did enumerate are still valid
399 # — but only replace the live index if we actually produced one.
400 find . -type f > "$DIR"/index.tmp || :
401 if [ -s "$DIR"/index.tmp ]; then
402 mv "$DIR"/index.tmp "$DIR"/index
403 fi
404 }
405
406 DIR=/var/download
407 cd "$DIR"
408 index
409 '';
410 };
411 };
412
413 services.jellyfin = {
414 enable = true;
415 group = "download";
416 };
417
418 # request managment
419 services.jellyseerr = {
420 enable = true;
421 openFirewall = true;
422 };
423
424 # movies
425 services.radarr = {
426 enable = true;
427 openFirewall = true;
428 user = "download";
429 group = "download";
430 };
431
432 # shows
433 services.sonarr = {
434 enable = true;
435 openFirewall = true;
436 user = "download";
437 group = "download";
438 };
439 # sonarr needs unsecure packages
440 nixpkgs.config.permittedInsecurePackages = [
441 "aspnetcore-runtime-wrapped-6.0.36"
442 "aspnetcore-runtime-6.0.36"
443 "dotnet-sdk-wrapped-6.0.428"
444 "dotnet-sdk-6.0.428"
445 "olm-3.2.16"
446 ];
447
448 # indexers
449 services.prowlarr = {
450 enable = true;
451 openFirewall = true;
452 };
453
454 # flaresolverr for bypassing cloudflare on some indexers
455 services.flaresolverr = {
456 enable = true;
457 openFirewall = true;
458 };
459
460 # subtitles
461 services.bazarr = {
462 enable = true;
463 openFirewall = true;
464 user = "download";
465 group = "download";
466 };
467
468 # usenet download client
469 services.sabnzbd = {
470 enable = true;
471 group = "download";
472 openFirewall = true;
473 };
474 # sonarr/radarr copy on import and leave the originals in sabnzbd's
475 # complete_dir (/var/download/usenet) forever; purge anything untouched
476 # for a week. Active imports are always younger than that.
477 systemd.tmpfiles.rules = [
478 "e /var/download/usenet - - - 7d"
479 ];
480}