94 lines
2.6 KiB
Nix
94 lines
2.6 KiB
Nix
{config, ...}: {
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
email = "xunuwu@gmail.com";
|
|
reloadServices = ["podman-caddy.service"];
|
|
};
|
|
certs = {
|
|
"xun.cam" = {
|
|
dnsProvider = "cloudflare";
|
|
credentialFiles = {
|
|
CF_DNS_API_TOKEN_FILE = config.sops.secrets.cloudflare.path;
|
|
};
|
|
extraDomainNames = ["jellyfin.desktop.xun.cam"];
|
|
};
|
|
};
|
|
};
|
|
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
autoPrune.enable = true;
|
|
dockerSocket.enable = true;
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /media/config/caddy/data 0750 root root -"
|
|
"d /media/config/caddy/config 0750 root root -"
|
|
"d /media/config/jellyfin/config 0750 root root -"
|
|
"d /media/config/jellyfin/cache 0750 root root -"
|
|
"d /media/library 0750 root root -"
|
|
];
|
|
|
|
virtualisation.oci-containers = {
|
|
backend = "podman";
|
|
|
|
containers = {
|
|
gluetun = {
|
|
image = "qmcgaw/gluetun:v3";
|
|
volumes = [
|
|
"${config.sops.secrets.wireguard.path}:/gluetun/wireguard/wg0.conf"
|
|
];
|
|
ports = [
|
|
## This bypasses the firewall
|
|
## use 127.0.0.1:XXXX:XXXX if you only want it to be accessible locally
|
|
"8096:8096" # jellyfin local network
|
|
"60926:60926" # jellyfin
|
|
];
|
|
|
|
environment = {
|
|
VPN_SERVICE_PROVIDER = "airvpn";
|
|
VPN_TYPE = "wireguard";
|
|
SERVER_COUNTRIES = "Netherlands";
|
|
FIREWALL_VPN_INPUT_PORTS = "60926";
|
|
};
|
|
|
|
extraOptions = [
|
|
"--cap-add=NET_ADMIN"
|
|
"--device=/dev/net/tun:/dev/net/tun"
|
|
];
|
|
};
|
|
jellyfin = {
|
|
image = "jellyfin/jellyfin";
|
|
volumes = [
|
|
"/media/config/jellyfin/config:/config"
|
|
"/media/config/jellyfin/cache:/cache"
|
|
"/media/library:/library"
|
|
];
|
|
dependsOn = ["gluetun"];
|
|
extraOptions = [
|
|
"--network=container:gluetun"
|
|
"--device=/dev/dri:/dev/dri"
|
|
];
|
|
};
|
|
caddy = {
|
|
image = "caddy";
|
|
volumes = [
|
|
"${builtins.toFile "Caddyfile" ''
|
|
https://jellyfin.desktop.xun.cam:60926 {
|
|
tls /etc/ssl/certs/xun.cam/cert.pem /etc/ssl/certs/xun.cam/key.pem
|
|
reverse_proxy localhost:8096
|
|
}
|
|
''}:/etc/caddy/Caddyfile"
|
|
"/var/lib/acme/xun.cam:/etc/ssl/certs/xun.cam"
|
|
"/media/config/caddy/data:/data"
|
|
"/media/config/caddy/config:/config"
|
|
];
|
|
dependsOn = ["gluetun"];
|
|
extraOptions = [
|
|
"--network=container:gluetun"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|