move around some stuff

nix/machines/nixdesk/jellyfin.nix

@@ -0,0 +1,94 @@
+{config, ...}: {
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "xunuwu@gmail.com";
+      reloadServices = ["podman-caddy.service"];
+    };
+    certs = {
+      "xun.cam" = {
+        dnsProvider = "cloudflare";
+        credentialFiles = {
+          CF_DNS_API_TOKEN_FILE = config.sops.secrets.cloudflare.path;
+        };
+        extraDomainNames = ["jellyfin.desktop.xun.cam"];
+      };
+    };
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerSocket.enable = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /media/config/caddy/data 0750 root root -"
+    "d /media/config/caddy/config 0750 root root -"
+    "d /media/config/jellyfin/config 0750 root root -"
+    "d /media/config/jellyfin/cache 0750 root root -"
+    "d /media/library 0750 root root -"
+  ];
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+
+    containers = {
+      gluetun = {
+        image = "qmcgaw/gluetun:v3";
+        volumes = [
+          "${config.sops.secrets.wireguard.path}:/gluetun/wireguard/wg0.conf"
+        ];
+        ports = [
+          ## This bypasses the firewall
+          ## use 127.0.0.1:XXXX:XXXX if you only want it to be accessible locally
+          "8096:8096" # jellyfin local network
+          "60926:60926" # jellyfin
+        ];
+
+        environment = {
+          VPN_SERVICE_PROVIDER = "airvpn";
+          VPN_TYPE = "wireguard";
+          SERVER_COUNTRIES = "Netherlands";
+          FIREWALL_VPN_INPUT_PORTS = "60926";
+        };
+
+        extraOptions = [
+          "--cap-add=NET_ADMIN"
+          "--device=/dev/net/tun:/dev/net/tun"
+        ];
+      };
+      jellyfin = {
+        image = "jellyfin/jellyfin";
+        volumes = [
+          "/media/config/jellyfin/config:/config"
+          "/media/config/jellyfin/cache:/cache"
+          "/media/library:/library"
+        ];
+        dependsOn = ["gluetun"];
+        extraOptions = [
+          "--network=container:gluetun"
+          "--device=/dev/dri:/dev/dri"
+        ];
+      };
+      caddy = {
+        image = "caddy";
+        volumes = [
+          "${builtins.toFile "Caddyfile" ''
+            https://jellyfin.desktop.xun.cam:60926 {
+              tls /etc/ssl/certs/xun.cam/cert.pem /etc/ssl/certs/xun.cam/key.pem
+              reverse_proxy localhost:8096
+            }
+          ''}:/etc/caddy/Caddyfile"
+          "/var/lib/acme/xun.cam:/etc/ssl/certs/xun.cam"
+          "/media/config/caddy/data:/data"
+          "/media/config/caddy/config:/config"
+        ];
+        dependsOn = ["gluetun"];
+        extraOptions = [
+          "--network=container:gluetun"
+        ];
+      };
+    };
+  };
+}